{"id":"CVE-2024-24919","published":"2024-05-28T19:15:10Z","modified":"2026-08-05T05:16:41Z","title":"Check Point Quantum Security Gateways Information Disclosure Vulnerability","vendor":"Check Point","product":"Quantum Security Gateways","tier":"core","eol":null,"description":{"text":"Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is an information disclosure vulnerability in Check Point Quantum Security Gateways, which can allow an attacker to read certain information from the gateway. It affects these devices when they are connected to the internet and have the Remote Access VPN or Mobile Access Software Blades enabled. An attacker can read sensitive information over the network without authentication or user interaction, with low attack complexity. A security fix that mitigates the vulnerability is available.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:03:48Z"},"cvss":{"score":8.6,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N","provenance":"source","from":"NVD"},"epss":{"score":0.99978,"percentile":0.9998,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-05-30","dueDate":"2024-06-20","ransomware":true,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://support.checkpoint.com/results/sk/sk182336 ; https://nvd.nist.gov/vuln/detail/CVE-2024-24919","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-05-27","exploitedFirstSeen":"2024-05-27","ransomware":true,"evidence":[{"url":"https://blog.checkpoint.com/security/enhance-your-vpn-security-posture","date":"2024-05-27"},{"url":"https://support.checkpoint.com/results/sk/sk182336","date":"2024-05-29"},{"url":"https://www.mnemonic.io/resources/blog/advisory-check-point-remote-access-vpn-vulnerability-cve-2024-24919/","date":"2024-05-29"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2024-05-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-05-31&host_type=src&vulnerability=cve-2024-24919","date":"2024-05-31"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-01&host_type=src&vulnerability=cve-2024-24919","date":"2024-06-01"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-02&host_type=src&vulnerability=cve-2024-24919","date":"2024-06-02"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-03&host_type=src&vulnerability=cve-2024-24919","date":"2024-06-03"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-06-04&host_type=src&vulnerability=cve-2024-24919","date":"2024-06-04"},{"url":"https://www.greynoise.io/blog/whats-going-on-with-checkpoint-cve-2024-24919","date":"2024-06-04"}],"evidenceTotal":731,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"https://support.checkpoint.com/results/sk/sk182336","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"https://support.checkpoint.com/results/sk/sk182336","tags":["Mitigation","Patch","Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-24919","tags":["US Government Resource"]},{"url":"https://www.mnemonic.io/resources/blog/advisory-check-point-remote-access-vpn-vulnerability-cve-2024-24919/","tags":["Third Party Advisory"]}],"techniques":[{"id":"T1202","name":"Indirect Command Execution","tactics":["stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"exploitation_technique","evidence":[],"comment":"CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. ","confidence":"high"},{"id":"T1005","name":"Data from Local System","tactics":["collection"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"primary_impact","evidence":[],"comment":"CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. ","confidence":"high"},{"id":"T1003.003","name":"NTDS","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. ","confidence":"high"},{"id":"T1003.008","name":"/etc/passwd and /etc/shadow","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. ","confidence":"high"},{"id":"T1059.004","name":"Unix Shell","tactics":["execution"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Improper Access Control","mappingType":"secondary_impact","evidence":[],"comment":"CVE-2024-24919 is an information disclosure/arbitrary file read vulnerability within Check Point's Quantum Security Gateway products. It's been reported that attacker are leveraging this vulnerability to retrieve, all files on the local file system, read sensitive data and extract credentials for all local accounts, including Active Directory, SSH keys, and certificates. ","confidence":"high"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2024-22282","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22282","exploited":true,"exploitedSince":"2024-05-30","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":42,"skipped":14,"earliest":"2024-05-30","earliestUrl":"https://github.com/c3rrberu5/CVE-2024-24919","repos":[{"name":"seed1337/CVE-2024-24919-POC","url":"https://github.com/seed1337/CVE-2024-24919-POC","stars":47,"created":"2024-05-31"},{"name":"ifconfig-me/CVE-2024-24919-Bulk-Scanner","url":"https://github.com/ifconfig-me/CVE-2024-24919-Bulk-Scanner","stars":31,"created":"2024-06-01"},{"name":"RevoltSecurities/CVE-2024-24919","url":"https://github.com/RevoltSecurities/CVE-2024-24919","stars":25,"created":"2024-05-31"},{"name":"GoatSecurity/CVE-2024-24919","url":"https://github.com/GoatSecurity/CVE-2024-24919","stars":20,"created":"2024-05-31"},{"name":"un9nplayer/CVE-2024-24919","url":"https://github.com/un9nplayer/CVE-2024-24919","stars":16,"created":"2024-05-31"}]},"metasploit":[{"name":"Check Point Security Gateway Arbitrary File Read","module":"auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919","type":"auxiliary","disclosureDate":null,"url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/checkpoint_gateway_fileread_cve_2024_24919.rb"}],"nuclei":[{"id":"CVE-2024-24919","name":"Check Point Quantum Gateway - Information Disclosure","severity":"high","path":"http/cves/2024/CVE-2024-24919.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-24919.yaml"}],"first":{"date":"2024-05-30","source":"PoC-in-GitHub","url":"https://github.com/c3rrberu5/CVE-2024-24919"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1202"],"provenance":"source"},{"stage":"primary","techniques":["T1005"],"provenance":"source"},{"stage":"secondary","techniques":["T1059.004","T1003.003","T1003.008"],"provenance":"source"}],"timeline":[{"date":"2024-05-27","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://blog.checkpoint.com/security/enhance-your-vpn-security-posture","provenance":"source"},{"date":"2024-05-28","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-24919","provenance":"source"},{"date":"2024-05-30","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/c3rrberu5/CVE-2024-24919","provenance":"source"},{"date":"2024-05-30","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-05-30","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-22282","provenance":"source"}],"speed":{"daysToPublicExploit":2,"firstExploitFrom":"PoC-in-GitHub","daysToKev":2},"priority":{"score":79.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 886 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"42 PoC-in-GitHub repos; 1 Metasploit module; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.02,"detail":"base score 8.6"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}