Attackers Target Check Point VPNs to Access Corporate Networks

A vulnerability in Confirm Stage digital private neighborhood (VPN) merchandise might most likely leak information to malicious actors.

In newest months, Confirm Stage researchers have seen an increase in attackers using distant entry VPNs as a golden ticket for preliminary neighborhood entry. A lot of cybersecurity distributors’ choices have been compromised, based mostly on a March 27 blog post, which prompted them to look into their very personal.

On Might 28, they discovered an information disclosure vulnerability affecting its security gateways with distant or cell entry enabled. The issue has been labeled CVE-2024-24919.

Thus far, there have solely been a handful of situations of attackers attempting to benefit from CVE-2024-24919 inside the wild. Nonetheless, “whereas there have been just some makes an try globally, it’s ample to acknowledge a growth and, additional importantly, a simple [cause] to verify it’s unsuccessful,” Confirm Stage chief of staff Gil Messing instructed Darkish Finding out on Tuesday.

Confirm Stage is urging all prospects with mobile-enabled VPNs to place in a newly released hotfix. Prospects who solely use VPNs site-to-site are moreover advised to place within the restore.

Threats to Distant Entry VPNs

Distant entry VPNs are a bit utterly totally different than the VPNs most people are used to. The place frequent ones route an individual’s Website online guests via shared servers to have the ability to conceal their Internet train, distant entry VPNs are used to supply explicit individuals with protected entry to explicit networks. They’re useful, as an illustration, in providing remote workers access to their employer’s inside belongings.

They’re moreover useful for malicious features. Fairly than having to, say, exploit a publicly coping with server, or a zero-day vulnerability, a hacker might use a distant entry VPN for clear, unfettered entry to an organization’s IT environment. From there, they could begin establishing persistence, probing for vulnerabilities, and far more. How, though, do they get admission to that VPN connection inside the first place?

Be taught the rest of this textual content on Dark Reading.

Related articles: