CVE-2024-24915: Checkpoint SmartConsole Info Disclosure

CVE-2024-24915 Overview

CVE-2024-24915 affects Check Point SmartConsole, the management client used to configure Check Point security gateways. The vulnerability stems from credentials being retained in process memory after use rather than being cleared. An attacker with Administrator permissions on the host running SmartConsole can dump the SmartConsole process memory and recover the credentials in cleartext. The issue is tracked under CWE-316 (Cleartext Storage of Sensitive Information in Memory) and CWE-312 (Cleartext Storage of Sensitive Information).

Critical Impact
An administrator on a Windows host running SmartConsole can extract cleartext credentials from process memory, enabling lateral movement and pivot into Check Point management infrastructure.

Affected Products

Check Point SmartConsole R81.10 (builds 400 through 429)
Check Point SmartConsole R81.20 (builds 640 through 663)
Check Point SmartConsole R82 (builds 1051 and 1053) on Microsoft Windows

Discovery Timeline

2025-06-29 - CVE-2024-24915 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24915

Vulnerability Analysis

SmartConsole is a Windows client used by administrators to authenticate to and manage Check Point Security Management Servers. During authentication and normal operation, credentials such as passwords or authentication tokens are loaded into the process's address space. The application does not zero out or otherwise scrub these secrets from memory once they are no longer needed. As a result, the sensitive material remains resident in the heap or associated buffers for the lifetime of the process. An actor with sufficient privileges on the host can capture a full memory dump of the SmartConsole.exe process and parse the raw memory to recover the credentials.

Root Cause

The root cause is improper handling of sensitive data lifecycle within the SmartConsole client. Credential material is stored in mutable managed or unmanaged buffers that are never explicitly cleared. Secure-string or memory-zeroing primitives are not applied after use, leaving credentials recoverable through standard memory forensics techniques.

Attack Vector

Exploitation requires an attacker to already hold Administrator permissions on the Windows workstation running SmartConsole. From that position, the attacker uses standard Windows tooling such as Task Manager, procdump, or MiniDumpWriteDump to produce a memory image of the SmartConsole process. Strings extraction or targeted pattern searches against the dump then reveal the retained credentials. Because the flaw yields management-tier credentials, the impact extends beyond the initially compromised endpoint into the Check Point management plane, threatening confidentiality, integrity, and availability of the managed firewall estate.

No exploitation of this issue has been observed in the wild, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Refer to the Check Point Security Advisory sk183545 for vendor guidance.

Detection Methods for CVE-2024-24915

Indicators of Compromise

Creation of .dmp files corresponding to the SmartConsole process, particularly in user-writable directories or temporary paths.
Invocation of memory-dumping utilities such as procdump.exe, taskmgr.exe (Create dump file action), rundll32.exe comsvcs.dll MiniDump, or PowerShell scripts calling MiniDumpWriteDump while SmartConsole.exe is running.
Unexpected process handle opens against SmartConsole.exe requesting PROCESS_VM_READ or PROCESS_ALL_ACCESS.

Detection Strategies

Alert on any process other than SmartConsole itself acquiring a read handle to the SmartConsole process address space.
Hunt for command-line patterns invoking procdump, comsvcs.dll MiniDump, or Out-Minidump where the target process name equals SmartConsole.
Correlate administrative logon events on workstations that host SmartConsole with subsequent file writes matching dump signatures (MDMP magic header).

Monitoring Recommendations

Enable Windows Defender Attack Surface Reduction rule blocking credential stealing from lsass.exe as a general control, and extend equivalent EDR policies to cover SmartConsole.exe.
Forward Sysmon Event ID 10 (ProcessAccess) telemetry to a centralized analytics platform and filter for accesses targeting SmartConsole.
Audit local Administrators group membership on workstations that run SmartConsole and treat those endpoints as privileged access workstations.

How to Mitigate CVE-2024-24915

Immediate Actions Required

Apply the fixed SmartConsole build referenced in Check Point advisory sk183545.
Restrict local Administrator rights on any Windows host that runs SmartConsole so that only trusted personnel can produce process dumps.
Rotate SmartConsole administrator credentials that may have been exposed on hosts where untrusted admins have historically had access.

Patch Information

Check Point published remediation guidance and updated SmartConsole builds through advisory sk183545. Administrators should upgrade affected R81.10, R81.20, and R82 SmartConsole installations to the fixed build listed in the advisory.

Workarounds

Run SmartConsole only from hardened, dedicated privileged access workstations that prohibit installation of debugging or memory-dumping tools.
Terminate the SmartConsole process immediately after administrative tasks complete to shorten the window during which credentials remain in memory.
Enforce multi-factor authentication on Check Point management accounts so that a recovered password alone is not sufficient to authenticate.

bash

# Example: audit local administrators on a SmartConsole host (run in elevated PowerShell)
Get-LocalGroupMember -Group "Administrators" | Format-Table Name, PrincipalSource, ObjectClass

# Example: detect SmartConsole memory dumps on disk
Get-ChildItem -Path C:\ -Recurse -Include *.dmp -ErrorAction SilentlyContinue |
  Where-Object { (Get-Content $_.FullName -TotalCount 1 -Encoding Byte) -contains 0x4D }