{"id":"CVE-2024-24919","kind":"vulnerability","aliases":["CVE-2024-24919"],"related":[],"title":"Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the…","description":"Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Check Point Quantum security gateways leak information to unauthenticated internet attackers when IPSec VPN, Remote Access VPN or Mobile Access is enabled. CISA lists it as actively exploited and tied to ransomware campaigns, which means attackers can pull data from exposed gateways.","severity":"high","cvss":8.6,"epss":null,"exploited":true,"exploited_at":"2024-05-30T00:00:00+00:00","products":[{"name":"Check Point Quantum Security Gateways","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"checkpoint quantum spark firmware","fixed":[],"affected":"= r80.40","ecosystem":"vendor"},{"name":"checkpoint quantum spark firmware","fixed":[],"affected":"= r81","ecosystem":"vendor"},{"name":"checkpoint quantum security gateway firmware","fixed":[],"affected":"= r80.40","ecosystem":"vendor"},{"name":"checkpoint cloudguard network security","fixed":[],"affected":"= r80.40","ecosystem":"vendor"},{"name":"checkpoint cloudguard network security","fixed":[],"affected":"= r81","ecosystem":"vendor"},{"name":"checkpoint cloudguard network security","fixed":[],"affected":"= r81.10","ecosystem":"vendor"},{"name":"checkpoint cloudguard network security","fixed":[],"affected":"= r81.20","ecosystem":"vendor"},{"name":"checkpoint quantum security gateway firmware","fixed":[],"affected":"= r81.20","ecosystem":"vendor"},{"name":"checkpoint quantum security gateway firmware","fixed":[],"affected":"= r81.10","ecosystem":"vendor"},{"name":"checkpoint quantum security gateway firmware","fixed":[],"affected":"= r81","ecosystem":"vendor"},{"name":"checkpoint quantum spark firmware","fixed":[],"affected":"= r81.10","ecosystem":"vendor"},{"name":"checkpoint quantum spark firmware","fixed":[],"affected":"= r80.20","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["check-point","exploited","infrastructure","network-appliance","ransomware","self-hosted","vpn"],"not_affected_if":["no-vpn-enabled","not-internet-exposed"],"how_to_check":"Check whether the gateway has IPSec VPN, Remote Access VPN or Mobile Access enabled and is reachable from the internet.","fix":"Apply the vendor mitigation per Check Point instructions, or stop using the affected gateway if no mitigation exists (CISA required action).","status":"open","published_at":"2024-05-28T19:15:10+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:47+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:58:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigation per Check Point instructions, or stop using the affected gateway if no mitigation exists (CISA required action).\nunknown","reach":"internet","impact":"medium","summary":"Check Point Quantum security gateways leak information to unauthenticated internet attackers when IPSec VPN, Remote Access VPN or Mobile Access is enabled. CISA lists it as actively exploited and tied to ransomware campaigns, which means attackers can pull data from exposed gateways.","category":"infrastructure","who_cares":["check-point","vpn","self-hosted","network-appliance"],"confidence":0.6,"needs_auth":"no","worst_case":"Unauthenticated attacker reads gateway information; exploited in ransomware campaigns","analyst_note":"Find the vendor advisory and affected/fixed versions and the exact mitigation steps; the sources give no version or command (see CISA KEV entry and Check Point security advisories).","how_to_check":"Check whether the gateway has IPSec VPN, Remote Access VPN or Mobile Access enabled and is reachable from the internet.\nunknown\nunknown","needs_analyst":true,"not_affected_if":["no-vpn-enabled","not-internet-exposed"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000527,"input_tokens":2933,"output_tokens":468,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':17A,20A '-24919':18A,21A 'access':107B,111B,152C,164C,168C 'action':194C 'activ':118B 'affect':172C 'allow':2A,148C 'appli':195C 'applianc':86B,191C 'attack':4A,102B,127B,150C 'campaign':124B 'certain':7A 'chassi':184C 'check':10A,22A,80B,92B,134C,177C 'check-point':79B 'checkpoint':27A,31A,35A,40A,44A,48A,52A,56A,61A,66A,71A,75A 'cisa':114B,192C 'cloudguard':41A,45A,49A,53A,180C 'connect':15A,156C 'contain':139C 'cve':16A,19A 'data':130B 'disclosur':143C 'discontinu':201C 'enabl':113B,169C 'exploit':82B,119B 'expos':132B 'firmware':30A,34A,39A,60A,65A,70A,74A,78A 'gateway':13A,38A,59A,64A,69A,96B,133B,138C,155C,187C 'gateways':26A 'host':90B 'includ':179C 'inform':8A,98B,142C,153C 'infrastructur':83B 'instruct':199C 'internet':101B,159C 'ipsec':104B,161C 'issu':171C 'leak':97B 'line':175C 'list':115B 'mean':126B 'mitig':196C,207C 'mobil':110B,167C 'network':42A,46A,50A,54A,85B,181C 'network-appli':84B 'per':197C 'point':11A,23A,81B,93B,135C,178C 'potenti':1A,147C 'product':174C,205C 'pull':129B 'quantum':24A,28A,32A,36A,57A,62A,67A,72A,76A,94B,136C,182C,185C,189C 'ransomwar':87B,123B 'read':6A 'remot':106B,163C 'requir':193C 'scalabl':183C 'secur':12A,95B,137C,186C 'security':25A,37A,43A,47A,51A,55A,58A,63A,68A 'self':89B 'self-host':88B 'sever':173C 'spark':29A,33A,73A,77A,190C 'tie':121B 'unauthent':100B 'unavail':209C 'unspecifi':141C 'use':202C 'vendor':198C 'vpn':91B,105B,108B,162C,165C 'vulner':144C,146C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-05-28T19:15:10+00:00","kev":{"dateAdded":"2024-05-30","dueDate":"2024-06-20","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","cvss_by":"cve@checkpoint.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-24919","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-24919","severity":null,"published_at":"2024-05-30T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T15:39:41+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-24919","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24919","severity":null,"published_at":"2024-05-28T19:15:10+00:00","modified_at":"2026-08-05T05:16:41+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}