CVE-2024-24919

KEV catalog · CISA Known Exploited Vulnerabilities

CVE-2024-24919 8.6

Check Point · Quantum Security Gateways · Added 2024-05-30 · Published 2024-05-28

3-Day Required PoC Available KEV Automatable Active Exploitation

Details

VulnerabilityCheck Point Quantum Security Gateways Information Disclosure Vulnerability

VendorCheck Point

ProductQuantum Security Gateways

Date added2024-05-30

Due date2024-06-20

CISA catalogView on CISA KEV catalog

Required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CWECWE-200

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N

Descriptions

KEV: Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances.

NVD: Potentially allowing an attacker to read certain information on Check Point Security Gateways once connected to the internet and enabled with remote Access VPN or Mobile Access Software Blades. A Security fix that mitigates this vulnerability is available.

Compliance SSVC + BOD 26-04

Automatableyes

Technical impactpartial

Exploitation statusactive

3-day qualifyingYes

Public timeline3 days

Non-public timeline14 days

Forensic (public)Not required

Forensic (non-public)Not required

Research metadata

Last researched2026-09-10 07:42 UTC

Wall time0.3s

Searches1

Component defaultunknown

Sources https://nvd.nist.gov/vuln/detail/CVE-2024-24919
https://support.checkpoint.com/results/sk/sk182336
https://support.checkpoint.com/results/sk/sk182337
https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/
https://www.rapid7.com/blog/post/2024/05/30/etr-cve-2024-24919-check-point-security-gateway-information-disclosure/
https://www.helpnetsecurity.com/2024/05/31/cve-2024-24919/
https://www.tenable.com/blog/cve-2024-24919-check-point-security-gateway-information-disclosure-zero-day-exploited-in-the
https://www.picussecurity.com/resource/blog/cve-2024-24919-check-point-security-gateways-zero-day-vulnerability-explained
https://blog.qualys.com/vulnerabilities-threat-research/2024/06/07/check-point-security-gateway-information-disclosure-vulnerability-cve-2024-24919
https://www.cyfirma.com/research/threat-actors-actively-exploiting-cve-2024-24919-underground-forums-share-ip-addresses-of-vulnerable-check-point-security-gateway-devices/
https://github.com/Rug4lo/CVE-2024-24919-Exploit
https://www.greynoise.io/blog/whats-going-on-with-checkpoint-cve-2024-24919
https://www.cert.europa.eu/publications/security-advisories/2024-053/

Hunting hypothesis agent

Hunt reverse-proxy/WAF logs for HTTPS `POST /clients/MyCRL` bodies containing `CSHELL/` plus `../` traversal (e.g. `aCSHELL/../../../../../../../etc/shadow`); Check Point logs omit POST bodies, so capture at the proxy.

Research details

ComponentRemote Access VPN / Mobile Access software blade — `/clients/MyCRL` static-file handler in the `sslvpn.full` binary (Check Point SVN Foundation HTTP server); its `strstr()`-based `sanitize_filename` allowlist check is bypassed by a path containing `CSHELL/`

PreconditionsThe target must be a Check Point Security Gateway with the Remote Access VPN community (IPSec VPN blade) or the Mobile Access software blade enabled and accessible over the internet on TCP port 443 (HTTPS). The gateway must be configured to accept password-based authentication rather than exclusively certificate-based authentication. The attacker does not require any prior authentication or user interaction. The exploit is delivered via an unauthenticated HTTP POST request to the `/clients/MyCRL` endpoint with a path traversal payload in the request body. agent

DeliveryAn attacker sends an unauthenticated HTTPS POST to `/clients/MyCRL` (Content-Length: 39) with a body such as `aCSHELL/../../../../../../../etc/shadow`. The `CSHELL/` token satisfies the flawed strstr() filename allowlist, and the trailing `../` sequences escape the static-file root so the Check Point SVN Foundation HTTP server returns arbitrary root-readable files.

Public PoCyes

PoC URLs https://github.com/Rug4lo/CVE-2024-24919-Exploit Third-party repos; verify before use.

Advisoryhttps://support.checkpoint.com/results/sk/sk182336

Exploit notesCVSS attack complexity: LOW | HIGH severity (CVSS 8.6). watchTowr patch-diffed `sslvpn.full` and found the `/clients/MyCRL` handler validates POST-body filenames with a substring `strstr()` check against an allowlist; requesting `aCSHELL/../../../../../../../etc/shadow` passes because `CSHELL/` is a permitted directory entry, then traverses out and returns root-readable files. Rug4lo's public Python PoC implements the same request. Affected devices need the Remote Access VPN/Mobile Access blade enabled.

SummaryCVE-2024-24919 is an arbitrary file read vulnerability in Check Point Security Gateways with Remote Access VPN or Mobile Access software blades enabled. The vulnerability resides in the `/clients/MyCRL` endpoint handler within the `sslvpn.full` binary, where a flawed `strstr()` filename validation can be bypassed by including a directory name like 'CSHELL/' in the path traversal payload. An unauthenticated remote attacker can read any file on the system with root privileges, including password hashes and configuration secrets. The vulnerability has been actively exploited in the wild since at least April 2024 and was added to CISA's Known Exploited Vulnerabilities catalog on May 30, 2024.

Tia coverage

First reported2026-07-23

First exploit report2026-07-23

Exploit report → KEV784 days after the listing

When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.

Mentioned in

cve-2026-16232-check-point-smartconsole-zero-day-actively-exploi

Record schema v1.0. Enrichment is research-grade, not a substitute for analyst review.