High severity · published Apr 18, 2024
CVE-2024-24910
A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server
7.3
CVSS
0.2%
EPSS
No
On KEV
Description
A local attacker can erscalate privileges on affected Check Point ZoneAlarm ExtremeSecurity NextGen, Identity Agent for Windows, and Identity Agent for Windows Terminal Server. To exploit this vulnerability, an attacker must first obtain the ability to execute local privileged code on the target system.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 4% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IA
Identity Agent · Checkpoint
through r81.070.0000 · source: NVD
ZE
Zonealarm Extreme Security Nextgen · Checkpoint
before 4.2.712 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-24910
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-24910
Vendor Advisory
https://support.checkpoint.com/results/sk/sk182219
More from Identity Agent
8.1
CVE-2021-30356
A denial of service vulnerability was reported in Check Point Identity Agent before R81.018.0000, which could allow low privileged users to overwrite protected system files
7.8
CVE-2026-10847
Local Privilege Escalation vulnerability in Check Point Identity Agent Full for Windows OS