Check Point Security Gateways - Directory Traversal (CVE-2024-24919)
Description
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
psychologyCrowdSec Analysis
CVE-2024-24919 is a vulnerability affecting Check Point Security Gateways, where attackers can potentially read sensitive information when remote access features are enabled and the device is internet-connected.
CrowdSec has been tracking this vulnerability and its exploits since 4th of June 2024.
CrowdSec network data shows that most actors exploiting CVE-2024-24919 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-24919 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-24919 is currently experiencing high visibility and active exploitation across the internet.
Exploitation attempts are typically identified by requests to URLs ending with /clients/mycrl.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2024-05-28 |
| CISA KEV | 2024-05-30 |
| Rule Released | 2024-06-04 |
| CISA Remediation Deadline | 2024-06-20 |
| CrowdSec First Seen | 2024-11-23 |