CVE-2024-24915
Checkpoint Smartconsole r81.10 … r82
Raw vector
CVSS:3.1/AV:P/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:HSummary
CVE-2024-24915 is a medium-severity Cleartext Storage of Sensitive Information in Memory (CWE-316) vulnerability in Checkpoint Smartconsole. Its CVSS base score is 6.1 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Credentials In Files (T1552.001); ranked at the 7th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-28 (Protection of Information at Rest) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-22278
Vulnerability Data
Credentials are not cleared from memory after being used. A user with Administrator permissions can execute memory dump for SmartConsole process and fetch them.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 7 hardening rules · 3 OS baselines
V14.2.8
Mitigating Controls (NIST 800-53 r5) AI
SC-28 requires cryptographic or equivalent protection of sensitive data at rest, directly stopping cleartext storage in accessible resources.
Access enforcement limits which subjects can read memory locations holding the cleartext data.
Process isolation confines the cleartext data to its own execution domain, shrinking exposure.
Prevents unintended transfer of the cleartext contents through shared memory resources.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect cleartext secrets in memory dumps or debug output.
Requiring non-standard deletion or physical destruction of media ensures that sensitive information is not left in cleartext on discarded or repurposed equipment.
Secure deletion of data before device transfer prevents residual sensitive information from remaining in cleartext on storage media that leave organizational control.
Secure deletion practices reduce residual cleartext after use, but do not prevent initial storage.
Substituting real values with hashes or encrypted tokens before storage reduces the quantity of cleartext sensitive information that ends up persisted on disk.
DLP tooling can monitor and block processes that leave sensitive data unencrypted in memory.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248525 All OL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at-rest protection. prevents CWE-312
Oracle Linux 9 (2 rules)
- V-271756 OL 9 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-312
- V-271730 OL 9 must disable storing core dumps. prevents CWE-316
RHEL 8 (1 rule)
- V-230224 All RHEL 8 local disk partitions must implement cryptographic mechanisms to prevent unauthorized disclosure or modification of all information that requires at rest protection. prevents CWE-312