What’s Going on With Check Point (CVE-2024-24919)? | Grey Noise Blog
Summary: Check Point published an advisory on May 28, 2024 for CVE-2024-24919, a CVSS 8.6 path traversal flaw in Security Gateway that runs as root and lets an attacker read any file on the filesystem, with in-the-wild attacks dating to April 7, 2024. GreyNoise saw its first working exploitation on May 31, 2024 around 9:40am UTC from a New York IP, 45.88.91.78, after an earlier broken attempt on May 30 from Taiwan-based 125.229.221.55, and Censys counted nearly 14,000 devices running some version of the software.
Key Takeaway: Attacks began nearly two months before the advisory, and with a working proof of concept public and payloads shifting day over day toward files like /sysimg/CPwrapper/SU/Products.conf and /config/db/initial, the window between disclosure and exploitation is already closed.
Read the original at GreyNoise Blog ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2024-24919
- Related
- CVE-2024-24919: Check Point Quantum Security Gateways Information Disclosure Vulnerability Known Exploited Vulnerabilities · May 30, 2024Storm⚡️Watch | Cyber Insights | Mysterious Router Hackers, Window's 11 Recall Concerns, and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026