CVE-2024-24919: Check Point Quantum Security Gateways Information Disclosure Vulnerability
Vulnerability summary
CVE-2024-24919 is a high (CVSS 8.6) vulnerability in Check Point Quantum Security Gateways. It is known to be exploited: CISA lists it, first on 30-05-2024. It has been used in ransomware campaigns. EPSS estimates a 99.98% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 28-05-2024PublishedVulnerability first disclosed.
- 30-05-2024Added to CISA KEVCheck Point Quantum Security Gateways Information Disclosure Vulnerability
- 20-06-2024CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 05-08-2026Last modifiedVulnerability information updated.
Description
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST8.6HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
99.98%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.98% on 19-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 30-05-2024
- Federal due date
- 20-06-2024
CISA required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. support.checkpoint.com/results/sk/sk182336 nvd.nist.gov/vuln/detail/CVE-2024-24919
Public exploits
2 foundExploit Reference (mnemonic.io)
Maturity: unknown
Check Point Security Gateway Arbitrary File Read
auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Checkpoint4 products
- check point quantum gateway, spark gateway and cloudguard networkCheck Point Quantum Gateway and CloudGuard Network versions R81.20, R81.10, R81, R80.40 and Check Point Spark versions R81.10, R80.20.
- cloudguard_network_securityr80.40 | r81 | r81.10 | r81.20
- quantum_security_gateway_firmwarer80.40 | r81.20 | r81.10 | r81
- quantum_spark_firmwarer80.40 | r81 | r81.10 | r80.20
1 vendor · 4 products
References
3 links- www.mnemonic.io/resources/blog/advisory-check-point-remote-access-vpn-vulnerability-cve-2024-24919/ExploitThird Party Advisory
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-24919Government ResourceUS Government Resource