CVE-2024-24919 kev+ ransomware in the critical feed json
Information disclosure
published 2024-05-28 2 y ago modified 2026-08-05 3 mo ago also EUVD-2024-22282
- cvss
- 8.6
- version 3.1, CNA
- cisa kev
- Exploited
- added 2024-05-30, used in ransomware
- epss
- 100.0%
- EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
- public exploits
- 1
- Metasploit, plus a Nuclei check
Summary
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
Patch / fix
cisa required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Timeline
- Published
- CISA SSVC: exploitation active
- Added to CISA KEV
- CISA patch deadline
Known exploited
- Added
- 2 y ago
- Patch by
- 2024-06-20 (2 y ago)
- Ransomware
- Known to be used in ransomware campaigns
- Required action
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Vendor, product
- Check Point, Quantum Security Gateways
- CISA name
- Check Point Quantum Security Gateways Information Disclosure Vulnerability
Ransomware
Groups reported to have exploited it in intrusions.
- Pioneer Kitten suspected state-sponsored
- NailaoLocker ransomware gang
reported by cisa.govorangecyberdefense.com
Ransomware Vulnerability Matrix by BushidoUK (github.com/BushidoUK/Ransomware-Vulnerability-Matrix), reformatted per CVE. CC BY 4.0
ATT&CK techniques
How it is exploited and what it leads to, in MITRE ATT&CK terms.
- T1202 Indirect Command Execution exploitation
- T1005 Data from Local System primary impact
- T1003.003 NTDS secondary impact
- T1003.008 /etc/passwd and /etc/shadow secondary impact
- T1059.004 Unix Shell secondary impact
kev release 2025-07-28, att&ck v16.1. KEV to ATT&CK mappings by the MITRE Center for Threat-Informed Defense (Mappings Explorer, Apache-2.0). © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. Terms of use
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
99.98% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919 Check Point Security Gateway Arbitrary File Read metasploit auxiliary, normal rank
- Nuclei template Check Point Quantum Gateway - Information Disclosure nuclei detection template
- mnemonic.io https://www.mnemonic.io/resources/blog/advisory-check-point-remote-access-vpn-vulnerability-cve-2024-24919/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
| NVD | 3.1 | 8.6 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected products
- checkpoint Check Point Quantum Gateway, Spark Gateway and CloudGuard Network
- checkpoint quantum_security_gateway_firmware
- checkpoint cloudguard_network
- checkpoint quantum_spark_appliances
Classification
- Weakness
-
- CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
References
-
support.checkpoint.com
/results/sk/sk182336
mitigation, patch, vendor-advisory
-
mnemonic.io
/resources/blog/advisory-check-point-remote-access-vpn-vulnerability-cve-2024-24919/
exploit, third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-24919
government-resource, us-government-resource
Sources
- CVE List CVE-2024-24919
- NVD CVE-2024-24919
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.