Cyber Resilience

CVE-2024-24914

Checkpoint Gaia Os r81 … r81.20

Published
07 November 2024
Modified
26 August 2025
Patch / advisory
View advisory
CVSS Score v3.1 8.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:A/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 34th percentile
Risk Priority 58 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2024-24914 is a high-severity Improper Control of Dynamically-Identified Variables (CWE-914) vulnerability in Checkpoint Gaia Os. Its CVSS base score is 8.0 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Data Manipulation (T1565); ranked at the 34th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

Authenticated Gaia users can inject code or commands by global variables through special HTTP requests. A Security fix that mitigates this vulnerability is available.

CWE(s)
CWE-914

Related Threats

MITRE ATT&CK Enterprise Techniques

T1565 Data Manipulation Impact
Adversaries may insert, delete, or manipulate data in order to influence external outcomes or hide activity, thus threatening the integrity of the data.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-24911Same product: Checkpoint Gaia Os
CVE-2024-54198Shared CWE-914
CVE-2024-24919Same product: Checkpoint Quantum Security Gateway
CVE-2026-16232Same product: Checkpoint Quantum Security Management
CVE-2024-52888Same product: Checkpoint Gaia Os
CVE-2024-52885Same product: Checkpoint Gaia Os
CVE-2024-52887Same product: Checkpoint Gaia Os
CVE-2026-50751Same product: Checkpoint Gaia Os
CVE-2025-3831Same vendor: Checkpoint
CVE-2023-28134Same vendor: Checkpoint

Affected Assets

checkpoint
gaia os
r81, r81.10, r81.20

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

Access enforcement directly stops unauthorized reads/writes to any named resource, including dynamically identified variables.

SI-10 Information Input Validation partial match

Input validation on variable identifiers stops malformed or unauthorized dynamic names from being used.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly prevent dynamic variable control flaws via coding standards, reviews, and testing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect and prevent dynamic-variable weaknesses before release.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle requires input validation and variable handling rules that reduce dynamic-variable misuse.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate strict control over dynamically-identified variables.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles discourage unsafe dynamic variable access patterns.

A.8.28 Secure coding partial match
prevents

Secure coding standards directly prohibit uncontrolled dynamic variable access.

References