CVE-2024-24919Check Point Security Gateway information disclosure of password hashes
What broke
Check Point Security Gateways (including VPN and firewall blades) exposed files that contained password hashes to an unauthenticated caller. Those hashes include local admin and, in some configurations, VPN user material. CISA added CVE-2024-24919 to KEV. Check Point shipped a hotfix in late May 2024. Exploitation followed.
Why it matters
A VPN gateway is an identity provider for remote access. Leaking its hashes is credential theft at the enforcement point, after which MFA on the same box may not save you if the attacker cracks a local account or replays a legacy hash. Same product class as Ivanti Connect Secure and FortiCloud SSO.
What to do
- Apply the Check Point hotfix. If the gateway was internet-facing in May 2024, rotate local admin and VPN credentials and review logs for unexpected reads of the leaked paths.
- Move VPN users onto phishing-resistant MFA that does not share a hash file with the appliance OS.
- Do not leave the management or information-leak paths on the same interface as the VPN.
After you patch
Edge appliances sit outside the estate and hold credentials into it, which is why this class keeps producing multi-victim campaigns.
- Revoke all sessions on the appliance, then rotate the directory or LDAP service account it uses for authentication.
- Rotate certificates and any stored integration credentials, since configuration stores on these devices are a routine post-exploitation target.
- Hunt for authenticated sessions with no matching interactive login, and for logins from ASNs that had never appeared before the disclosure date.
- Check downstream: anything the appliance could reach or authenticate to is in scope, including SSO-connected applications.
Sources
- NVD: CVE-2024-24919
- CISA KEV
- Check Point sk182337 / May 2024 hotfix
Related identity CVEs
- CVE-2026-16232Check Point SmartConsole login hands an unauthenticated attacker an admin token
- CVE-2026-50751Check Point Remote Access VPN lets attackers in without a password over IKEv1
- CVE-2024-21893Ivanti Connect Secure SAML SSRF, chained to auth bypass
- CVE-2023-46805Ivanti Connect Secure authentication bypass
Related on Start with Identity
- CVECheck Point VPN certificate validation flaw, from one-day to pre-auth RCE on the gateway
Check Point Security Gateway and Spark firewalls mishandled certificate data during VPN negotiation, giving unauthenticated code execution. Patched September 9,
- CVECheck Point Remote Access VPN lets attackers in without a password over IKEv1
A certificate validation logic flaw in Check Point Remote Access and Mobile Access over deprecated IKEv1 let attackers open a VPN session without a valid passwo
- Blog39% of identity CVEs are on CISA KEV, and edge appliances hold 62% of the exploited ones
SWI's Identity Vulnerability Report 2026 checked 137 identity CVEs against CISA's Known Exploited Vulnerabilities catalog and NVD. 53 are exploited, most of the
- BlogCISA adds the last two Ivanti Connect Secure chain flaws to KEV after Ivanti's October 29 patch
CISA added Ivanti Connect Secure CVE-2026-111357 and CVE-2026-118527 to its exploited list on October 30, a day after Ivanti patched the root escalation UTA0576
- BlogIvanti Connect Secure auth bypass exploited; CISA gave agencies three days
CVE-2026-104935 lets an unauthenticated attacker bypass Ivanti Connect Secure's login with a crafted header and run commands. Exploited since early October by a
- CVEIvanti Connect Secure authentication bypass
Connect Secure and Policy Secure skipped authentication on a path that later chained with CVE-2024-21887 for unauthenticated RCE. CISA KEV. January 2024 disclos