Start with Identity
Subscribe
Identity CVE · Other

CVE-2024-24919Check Point Security Gateway information disclosure of password hashes

criticalCISA KEVActively exploited
Product: Check Point Security GatewayVendor: Check PointDisclosed: 2024-05-28Status: Actively exploitedNVD ↗CISA KEV ↗

What broke

Check Point Security Gateways (including VPN and firewall blades) exposed files that contained password hashes to an unauthenticated caller. Those hashes include local admin and, in some configurations, VPN user material. CISA added CVE-2024-24919 to KEV. Check Point shipped a hotfix in late May 2024. Exploitation followed.

Why it matters

A VPN gateway is an identity provider for remote access. Leaking its hashes is credential theft at the enforcement point, after which MFA on the same box may not save you if the attacker cracks a local account or replays a legacy hash. Same product class as Ivanti Connect Secure and FortiCloud SSO.

What to do

  • Apply the Check Point hotfix. If the gateway was internet-facing in May 2024, rotate local admin and VPN credentials and review logs for unexpected reads of the leaked paths.
  • Move VPN users onto phishing-resistant MFA that does not share a hash file with the appliance OS.
  • Do not leave the management or information-leak paths on the same interface as the VPN.

Sources

Related identity CVEs

Know a primary source we should add, or a patch status that has changed? Email [email protected]. See all briefs in the identity CVE catalog, or volunteer as a CVE Analyst.
Compiled from vendor advisories, NVD, CISA KEV, and public research. CVSS figures can disagree across NVD and the CNA. Confirm affected versions against the vendor advisory before you patch. Independent, community-driven analysis. See the disclaimer.