CVE-2024-24916: Checkpoint SmartConsole RCE Vulnerability

CVE-2024-24916 Overview

CVE-2024-24916 is a DLL hijacking vulnerability affecting the Check Point SmartConsole installer on Microsoft Windows. The installer loads untrusted Dynamic Link Libraries (DLLs) placed in its working directory, resulting in arbitrary code execution with administrator privileges. The weakness is classified under CWE-427 (Uncontrolled Search Path Element). Exploitation requires local access and user interaction, such as running the installer from a directory that also contains an attacker-controlled DLL. Successful exploitation grants the attacker full control of the affected Windows host.

Critical Impact
An attacker who plants a malicious DLL alongside the Check Point SmartConsole installer can execute arbitrary code with administrator privileges on the target Windows system.

Affected Products

Check Point SmartConsole R81.10 (builds 400 through 425)
Check Point SmartConsole R81.20 (builds 640 through 655)
Microsoft Windows (all supported versions running the affected installer)

Discovery Timeline

2025-06-19 - CVE-2024-24916 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-24916

Vulnerability Analysis

The Check Point SmartConsole installer resolves several dependent DLLs at startup using the default Windows library search order. When the installer executes, Windows searches the application's directory before secure system paths. An attacker who can place a malicious DLL in the same directory as the installer causes that DLL to be loaded and its DllMain executed inside the installer process. Because the installer runs with administrative privileges to write to protected paths and register services, the injected code inherits those privileges. The result is arbitrary code execution as an administrator on the local machine.

Root Cause

The root cause is uncontrolled search path handling ([CWE-427]) in the SmartConsole installer. The installer does not use safe DLL loading practices, such as calling SetDefaultDllDirectories with LOAD_LIBRARY_SEARCH_SYSTEM32 or specifying fully qualified paths to LoadLibrary. Any DLL name resolved through the default search order can be satisfied by an attacker-supplied file that sits next to the installer executable.

Attack Vector

Exploitation requires local access to the target system and user interaction. A common scenario involves an attacker delivering the installer inside a compressed archive, a shared network folder, or the browser downloads directory that already contains a malicious DLL with a name matching one the installer loads. When the user launches the installer, Windows loads the attacker's DLL from the current directory before falling back to system locations. The installer's elevation prompt then applies to the combined process, giving the attacker administrator-level code execution. Refer to the Check Point Security Advisory sk183342 for vendor-supplied technical details.

Detection Methods for CVE-2024-24916

Indicators of Compromise

Unsigned or unexpected DLL files residing in the same directory as SmartConsole installer executables, particularly in user-writable locations such as Downloads, Temp, or removable media.
SmartConsole installer processes loading modules from paths outside C:\Program Files or C:\Windows\System32.
Child processes spawned by the SmartConsole installer that do not correspond to legitimate Check Point binaries (for example, cmd.exe, powershell.exe, or rundll32.exe).

Detection Strategies

Hunt Sysmon Event ID 7 (Image Loaded) records where the loading process is a SmartConsole installer and the loaded DLL originates from a non-standard directory.
Alert on Sysmon Event ID 1 (Process Create) entries showing the SmartConsole installer launched from a user-writable directory that also contains DLL files.
Correlate installer execution with subsequent privileged actions such as service creation, scheduled task registration, or Local Security Authority (LSA) access.

Monitoring Recommendations

Monitor endpoints for elevation of privilege events (Windows Event ID 4672) tied to the SmartConsole installer process.
Track file creation events for .dll files dropped into directories that contain Check Point installer binaries.
Baseline the legitimate DLL set loaded by the SmartConsole installer and alert on deviations.

How to Mitigate CVE-2024-24916

Immediate Actions Required

Apply the fixed SmartConsole build referenced in Check Point sk183342 before running the installer on any host.
Only execute the SmartConsole installer from a trusted, restricted directory that contains no additional files placed by untrusted users.
Restrict administrative rights so that only authorized personnel can launch installers that require elevation.

Patch Information

Check Point has issued a fixed release documented in the Check Point Security Advisory sk183342. Administrators should download the updated SmartConsole build directly from the Check Point User Center and validate the digital signature before execution. Remove older SmartConsole installer copies from shared locations, user desktops, and software repositories to prevent accidental reuse of vulnerable builds.

Workarounds

Copy the installer into a newly created, empty directory under C:\Program Files or another location writable only by administrators before launching it.
Block execution of installers from user-writable paths using Windows Defender Application Control (WDAC) or AppLocker policies until the patched version is deployed.
Enable Microsoft's CWDIllegalInDllSearch registry setting to remove the current working directory from the DLL search path for the installer process.

bash

# Example WDAC/AppLocker-style guidance to block installer execution from user-writable paths
# Deny SmartConsole installer execution outside a trusted directory
New-AppLockerPolicy -RuleType Path -User Everyone -Action Deny \
  -Path "%USERPROFILE%\Downloads\*SmartConsole*.exe"

# Harden DLL search order system-wide (requires reboot)
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager" \
  /v CWDIllegalInDllSearch /t REG_DWORD /d 0xFFFFFFFF /f