Attackers Target Check Point VPNs to Access Corporate Networks

A vulnerability in Check Point virtual private network (VPN) products could potentially leak information to malicious actors.

In recent months, Check Point researchers have observed an increase in attackers using remote access VPNs as a golden ticket for initial network access. Multiple cybersecurity vendors' solutions have been compromised, according to a  March 27 blog post, which prompted them to look into their own.

On May 28, they discovered an information disclosure vulnerability affecting its security gateways with remote or mobile access enabled. The issue has been labeled CVE-2024-24919.

Thus far, there have only been a handful of cases of attackers attempting to exploit CVE-2024-24919 in the wild. However, "while there have been only a few attempts globally, it's enough to recognize a trend and, more importantly, a straightforward [cause] to ensure it's unsuccessful," Check Point chief of staff Gil Messing told Dark Reading on Tuesday.

Check Point is urging all customers with mobile-enabled VPNs to install a newly released hotfix. Customers who only use VPNs site-to-site are also advised to install the fix.

Threats to Remote Access VPNs

Remote access VPNs are a bit different than the VPNs most people are used to. Where regular ones route an individual's Internet traffic through shared servers in order to conceal their Internet activity, remote access VPNs are used to provide specific individuals with secure access to specific networks. They're useful, for instance, in providing remote workers access to their employer's internal resources.

They're also useful for malicious purposes. Rather than having to, say, exploit a publicly facing server, or a zero-day vulnerability, a hacker could use a remote access VPN for clean, unfettered access to an organization's IT environment. From there, they could begin establishing persistence, probing for vulnerabilities, and much more. How, though, do they get access to that VPN connection in the first place?

Read the rest of this article on Dark Reading.

Related articles: