Check Point, a leading cybersecurity company, has issued a warning about a zero-day vulnerability in its Network Security gateway products. This vulnerability, tracked as CVE-2024-24919, has already been exploited by threat actors in the wild.
The vulnerability affects various products including CloudGuard Network, Quantum Maestro, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark appliances. According to Check Point, "The vulnerability potentially allows an attacker to read certain information on Internet-connected Gateways with remote access VPN or mobile access enabled."
Check Point has released hotfixes for the following versions:
- Quantum Security Gateway and CloudGuard Network Security Versions - R81.20, R81.10, R81, R80.40
- Quantum Maestro and Quantum Scalable Chassis - R81.20, R81.10, R80.40, R80.30SP, R80.20SP
- Quantum Spark Gateways Version - R81.10.x, R80.20.x, R77.20.x
This warning comes shortly after the company reported attacks targeting its VPN devices to infiltrate enterprise networks. "By May 24, 2024, we identified a small number of login attempts using old VPN local-accounts relying on unrecommended password-only authentication method," Check Point noted earlier this week.
This vulnerability has been linked to a new high-severity zero-day discovered in Security Gateways with IPSec VPN, Remote Access VPN and the Mobile Access software blade. The company has not provided specific details about the attacks, but mentioned that the exploitation attempts observed so far focus on "remote access on old local accounts with unrecommended password-only authentication" against a "small number of customers."
The targeting of VPN devices is the latest in a series of attacks on network perimeter applications. Similar attacks have impacted devices from Barracuda Networks, Cisco, Fortinet, Ivanti, Palo Alto Networks, and VMware in recent years.
"Attackers are motivated to gain access to organizations over remote-access setups so they can try to discover relevant enterprise assets and users, seeking for vulnerabilities in order to gain persistence on key enterprise assets," Check Point warned.
Users are urged to update their systems to the latest versions to protect against this vulnerability.
