The Check Point Research Division CP discovered a vulnerability in Security Gateways with remote access VPN or mobile access blade enabled (CVE-2024-24919). The vulnerability potentially allows an attacker to read certain information on Gateways once connected to the Internet and enabled with Remote Access VPN or Mobile Access. The attempts we have seen so far, inline with what we alerted to our customers on May 27th, are focusing on remote access on old local accounts with unrecommended password-only authentication.
Yeah, I realsied that after I looked at today’s date
To be fair I also read the intial Checkpoint advisory on the 27th when it was just about weak local passwords and today read it again now they have also come across whatever the information disclosure issue is that they have found as well.
Yeah, the intial advisory on the 27th was just about weak local accounts, which you could mitigate by deleting local accounts and/or disabling legacy auth.
Then they updated it on the 28th to show that there was also an issue with information disclosure which is seperate from the local account issue and the only mitigation is to disable Mobile Access and IPSec or only Mobile Access and disable all Remote Access clients or apply the patch.
182336 is “Preventative Hotfix for CVE-2024-24919”, 182337 is “FAQ for CVE-2024-24919” which also contains links for the hotfix but also extended information about timeline of discoveries etc.
