Cyber Security Alert: CVE affecting Check Point Security Gateway

The NCSC would like to draw your attention to CVE-2024-24919 affecting Check Point Security Gateway. The NCSC is aware of public reporting of active exploitation, which refers to activity since at least 30 April 2024.

This is a critical zero-day information disclosure vulnerability. CVE-2024-24919 allows an attacker to access sensitive information on internet-connected Gateways which have been configured with IPSec VPN, remote access VPN or mobile access software blade.

The NCSC encourages organisations in New Zealand that use the affected product to review the vendor advisory(external link) which provides information on how to apply the hotfix as well the device versions impacted. The advisory contains a number of extra measures, including resetting LDAP credentials if the Security Gateway is configured to use this. We recommend reviewing all of the extra measures detailed in the vendor advisory.

If your organisation has seen or does see evidence of compromise related to CVE-2024-24919, please contact ncscincidents@ncsc.govt.nz.

Received an alert or advisory from both CERT NZ and NCSC? At present, we use both brands and a range of distribution mechanisms to ensure everyone continues to receive the information they need. Behind the scenes, our teams continue to work together to share insights and align our guidance.

For more NCSC NZ updates, follow(external link) us on LinkedIn.