Check Point Security Gateway Remote Access VPN Arbitrary File Read Vulnerability (CVE-2024-24919) Technical Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTCheck Point Security Gateways connected to the internet with Remote Access VPN or Mobile Access Software Blades enabled
Unauthenticated remote attackers can read sensitive system files (e.g., /etc/shadow, password hashes, configuration files), potentially leading to credential theft and full network compromise
Immediately apply the official hotfix provided in Check Point Advisory sk182336, audit system logs for IoCs, and rotate all sensitive credentials
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official hotfix (sk182336) immediately using the Check Point Upgrade Service Engine (CPUSE) via the Clish interface:
# Update CPUSE agent and import the downloaded hotfix package
clish -c 'installer agent update'
clish -c 'installer import local /var/log/Check_Point_Hotfix_CVE-2024-24919.tgz'
# Install the hotfix and verify the installation status
clish -c 'installer install Check_Point_Hotfix_CVE-2024-24919'
clish -c 'show installer packages installed'2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the VPN portal ports (e.g., TCP 443) to trusted IP addresses only, or temporarily disable the Mobile Access Blade:
# Disable the Mobile Access Blade via Clish
clish -c 'set mobile-access state off'
clish -c 'save config'3. Log Audit & IoC Verification Commands
Inspect the web server and system logs for unauthorized access attempts targeting the vulnerable endpoints:
# Search for suspicious requests targeting the MyClients endpoint
grep -i 'MyClients' /var/log/httpd/*.log 2>/dev/null
# Scan system logs for attempts to access sensitive system files
egrep -i '(etc/shadow|etc/passwd|boot.config)' /var/log/messagesStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
CVE-2024-24919 is a critical information disclosure vulnerability (CWE-200) affecting Check Point Security Gateways. The root cause lies in insufficient input validation on specific web-facing endpoints associated with the Remote Access VPN and Mobile Access Software Blades. This allows unauthenticated attackers to perform directory traversal and read arbitrary files from the gateway's local file system.
2. Exploitation Mechanics & Attack Scenario
An attacker sends a crafted HTTP POST request containing directory traversal sequences to vulnerable endpoints (such as '/clients/MyClients') without requiring any authentication. The gateway processes the request and returns the contents of sensitive files, such as '/etc/shadow' or configuration databases. With access to password hashes, attackers can perform offline brute-force attacks to crack administrative credentials and gain unauthorized remote access to the internal network.
3. Infrastructure & Business Impact
This vulnerability is listed in the CISA KEV catalog and has an EPSS score of 0.9998, indicating active, widespread exploitation in the wild. Because VPN gateways serve as the perimeter defense, compromise of these devices can lead to lateral movement, ransomware deployment, and complete infrastructure takeover, posing an extreme risk to business continuity.
Official Vendor Advisories & References
Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.
Frequently Asked SecOps Questions (CVE-2024-24919)
FAQQ1. How critical is CVE-2024-24919 and is it actively exploited in the wild?
CVE-2024-24919 is rated CVSS 8.6 (HIGH) with a 30-day EPSS exploitation probability of 100.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-24919?
Primary impacted vendors include checkpoint across security gateway, remote access vpn, mobile access. Scope summary: All Check Point Security Gateway software versions with Remote Access VPN or Mobile Access Software Blades enabled
Q3. What temporary mitigations or workarounds exist for CVE-2024-24919 before patching?
[Mitigation] Immediately apply the official hotfix provided in Check Point Advisory sk182336, audit system logs for IoCs, and rotate all sensitive credentials Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-24919
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (checkpoint)
View Category →Check Point Remote Access VPN and Mobile Access Authentication Bypass Vulnerability (CVE-2026-50751) Security Advisory
[Affected Scope] Check Point Remote Access and Mobile Access VPN gateways utilizing the deprecated IKEv1 key exchange protocol
Check Point SmartConsole Authentication Bypass and Privilege Escalation Vulnerability (CVE-2026-16232) Advisory
[Affected Scope] Check Point Security Management Servers and SmartConsole instances exposed to the internet without Trusted Clients restrictions configured
Cisco Catalyst SD-WAN Software Information Disclosure Vulnerability (CVE-2026-20133)
[Affected Scope] Network devices and virtual appliances running Cisco Catalyst SD-WAN Software
Fortinet FortiOS Sensitive Information Exposure and Symbolic Link Patch Bypass (CVE-2025-68686)
[Affected Scope] Fortinet FortiOS versions 7.6.0 through 7.6.1, 7.4.0 through 7.4.6, and all versions of 7.2, 7.0, and 6.4
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.