Maverc
All articlesVulnerabilities

CVE-2024-24919 — Zero-Day Vulnerability Exploiting Check Point Security Gateways

July 26, 20245 min readMaverc Threat Research · Threat Advisory
VulnerabilitiesZero-DayThreat AdvisoryNetwork Security
CVE-2024-24919 — Zero-Day Vulnerability Exploiting Check Point Security Gateways

A high-severity information disclosure vulnerability in Check Point Security Gateways is being actively exploited. Here's what to do now.

CVE-2024-24919 has been identified in Check Point Security Gateways. This high-severity information disclosure vulnerability is actively being exploited in the wild, posing significant risks to organizations using Check Point products.

What It Affects

The flaw impacts Check Point Security Gateways with Remote Access VPN or Mobile Access blade enabled. An unauthenticated attacker can read sensitive information from the gateway, including credentials and configuration data that enable further compromise.

Immediate Actions

  • Apply the Check Point hotfix released for affected versions immediately.
  • Rotate any local accounts on the gateway and any credentials that may have been exposed.
  • Review authentication logs for anomalous local-account activity.
  • Where possible, disable Mobile Access or Remote Access VPN until patched.

Indicators of Compromise

Hunt for unexpected reads of sensitive files on the gateway, password-spray patterns against VPN portals from new IPs, and successful logins to local accounts that should not be in use. Maverc customers have hunt packages deployed; contact your account team for the latest IOC list.

Keep reading

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack
Identity Security

Beyond MFA: Why Adversary-in-the-Middle Phishing Is Eating Your Identity Stack

Push-based MFA was a decade-old patch on a broken model. Here's how AiTM toolkits like EvilProxy and Tycoon 2FA defeat it — and the phishing-resistant controls that actually stop them.

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had
Compliance

The CMMC Level 2 Readiness Checklist We Wish Every DIB Contractor Had

If you handle CUI, the C3PAO assessment is coming. Here's the 10-step readiness path Maverc walks every defense industrial base client through before the auditor shows up.

What a Modern OT Ransomware Attack Looks Like — And How to Survive One
OT / ICS Security

What a Modern OT Ransomware Attack Looks Like — And How to Survive One

From IT pivot to PLC shutdown, today's OT ransomware crews follow a repeatable playbook. Here is what we see in the field and the segmentation controls that contain the blast.