Preventative Hotfix for CVE-2024-24919 - Spark Firewall

Please read this important update from Check Point.

Security Alert:

High

Product: Spark Firewall
Version: R77.20 (EOS), R80.20.X (EOS), R81.10.X
OS: Gaia Embedded
Last Modified: 2025-02-23

Solution

For Security Gateways that run the Gaia OS, refer to sk182336: Preventative Hotfix for CVE-2024-24919 - Quantum Gateway Information Disclosure.

Following our security update on May 27, 2024, Check Point's dedicated task force continues investigating attempts to gain unauthorized access to VPN products used by our customers. On May 28, 2024 we discovered a vulnerability (CVE-2024-24919) in Security Gateways with Remote Access VPN or the Mobile Access software blade enabled. Exploiting this vulnerability can result in accessing sensitive information on the Security Gateway.

This, in certain scenarios, can potentially lead the attacker to move laterally and gain domain admin privileges.

If you need any additional assistance, contact Check Point Support or your local Check Point representative.

Quantum Spark Gateway images that include the mandatory Hotfix to prevent exploit of CVE-2024-24919

Step 1 of 3 - Check the current firmware build on your Quantum Spark Gateway

1. Connect to the WebUI on the Quantum Spark Gateway from a computer on an internal network:

https://<IP Address of Appliance>:4434

Example: https://192.168.1.1:4434

2. On the left panel, click the Home view.
3. In the Overview section, click the System page.
4. Below the hostname, refer to the field Version.

Example:

Step 2 of 3 - Upgrade your Quantum Spark Gateway to an image that includes the mandatory Hotfix to prevent exploit of CVE-2024-24919

Note - If your Quantum Spark Gateway already runs one of the mandatory firmware images, then it is not necessary to upgrade again, unless you received a private firmware build from Check Point Support (the private firmware build must be greater than the mandatory build listed above).

1. Download the mandatory firmware image from the corresponding Home Page SK article (see the summary table above).
2. Follow the R81.10.X Quantum Spark Locally Managed Administration Guide > chapter "Managing the Device" > section "Backup, Restore, Upgrade, and Other System Operations".

Step 3 of 3 - Follow the important extra measures

1. Disable the Remote Access VPN blade

• If you do not use the Remote Access VPN feature, then disable it:
  1. Click the VPN view.
  2. In the Remote Access section, click Blade Control.
  3. At the top of the page, click Off.

     2. Change the passwords for administrator users (and use complex passwords) and local users
     3. Restrict access through "Reach My Device"
     4. Enable Two-Factor Authentication for Administrators (R81.10.10 and higher)
     5. Enable notifications for administrator access
     6. Reinitialize Internal Certificate Authority (CA)
     7. Change the shared secret in the RADIUS Server settings
     8. Change the shared secret in the TACACS+ Server settings
     9. Change the password in the Active Directory server settings
     10. Change the password in the Wireless settings

Article Revision History