# CVE-2024-24919: Check Point Security Gateways - Directory Traversal

> Live exploitation tracking for CVE-2024-24919 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2024-24919

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 8.6
- **Public exploit available:** Yes
- **Affected products:** Checkpoint Quantum Gateway, Checkpoint Spark Gateway, Checkpoint Cloudguard Network
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor)
- **Tags:** enterprise_software, firewall

## Description

Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

## CrowdSec analysis

[CVE-2024-24919](https://euvd.enisa.europa.eu/vulnerability/CVE-2024-24919) is a vulnerability affecting Check Point Security Gateways, where attackers can potentially read sensitive information when remote access features are enabled and the device is internet-connected.

CrowdSec has been tracking this vulnerability and its exploits since 4th of June 2024.

CrowdSec network data shows that most actors exploiting CVE-2024-24919 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2024-24919 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2024-24919 is currently experiencing high visibility and active exploitation across the internet.

Exploitation attempts are typically identified by requests to URLs ending with `/clients/mycrl`.

## Timeline

- 2024-05-28: CVE Published. CVE-2024-24919 is published to NVD.
- 2024-05-30: CISA KEV. CVE-2024-24919 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-06-04: Rule Released. CrowdSec releases a rule to detect CVE-2024-24919 exploitation attempts against the CrowdSec Network.
- 2024-06-20: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2024-11-23: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2024-24919 for the first time.

## References

- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24919.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2024-24919) follows observed exploitation activity for CVE-2024-24919. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.