Adrian Johnson
TLDR:
Check Point is warning customers to patch their VPN software immediately due to a zero-day vulnerability under active exploitation. The vulnerability affects CloudGuard Network, Quantum Maestro, and other systems. Customers are urged to update to prevent attackers from accessing sensitive information and gaining domain administrator privileges. Additionally, other critical vulnerabilities in Linux kernels and various products have been identified and need to be addressed. On a lighter note, a scam involving offering a “free piano” as bait has been uncovered, targeting university students and faculty primarily in North America. Cooler Master also suffered a data breach, with personal information of customers being improperly accessed.
Article:
Security software vendor Check Point has detected a zero-day vulnerability under active exploitation in its VPN software and is urging customers to update their systems immediately. The vulnerability affects various Check Point systems including CloudGuard Network, Quantum Maestro, and Quantum Security Gateways. The company has assigned a CVE (CVE-2024-24919) to the vulnerability with a CVSS score of 8.6.
Check Point did not provide detailed information about the vulnerability but mentioned that attackers are exploiting old VPN local accounts using an unrecommended password-only authentication method. Patches are available for all affected systems. Threat intelligence firm Mnemonic confirmed that the vulnerability allows threat actors to retrieve sensitive information from security gateways by exploiting local accounts.
Aside from the VPN vulnerability, Check Point also highlights other critical vulnerabilities in Linux kernels and various products such as Westermo’s EDW-100 serial to Ethernet converters, Baxter Welch Allyn’s product configuration tool, LenelS2’s Netbox event monitoring software, and others. Customers are advised to check their kernel versions and update as needed to mitigate potential risks.
In a more lighthearted scam revelation, security outfit Proofpoint has uncovered an advanced fee fraud (AFF) scam involving a “free piano” offer to victims, primarily targeting university students and faculty in North America. The scam involves offering a free piano due to various reasons, with the catch being that recipients have to pay for shipping. While it may sound too good to be true, the scam has generated over $900,000 in a Bitcoin wallet linked to the scheme.
Additionally, Cooler Master, a computer components manufacturer, experienced a data breach where 103 GB of data was allegedly stolen from the company’s Fanzone support site. The stolen data includes names, phone numbers, addresses, and credit card information of loyalty members. The hacker behind the breach claimed to have accessed data of over 500,000 customers and plans to sell it on a hacking forum, posing a risk to affected customers’ identity security.
