CVE-2024-21887criticalunder attackransomwareCWE-77

CVE-2024-21887: critical vulnerability in Ivanti ICS

Published · Updated

Follow this CVE+ Monitor Connect Secure+ Monitor Policy Secure

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA, has an official Brazilian government alert and has a working public exploit.

ssvc Actcvss 9.1epss 100%
from disclosure to weapon2 days
Published on NVDJan 12
1st PoC+2d
metasploitJan 10
CISA KEVJan 10
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

  • CTIR Gov · ALERTA 02/2024Atualizações sobre vulnerabilidades em produtos Volexity Ivantiread on gov.br ↗
  • CTIR Gov · ALERTA 01/2024Vulnerabilidades críticas em produtos Volexity Ivantiread on gov.br ↗
Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
Action required by CISAfederal deadline: 2024-01-22

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An authenticated administrator can send specially crafted requests to Ivanti Connect Secure or Policy Secure to execute arbitrary commands on the system. This allows an insider with admin access to take complete control of the appliance.

Technical detail

Command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Policy Secure (9.x, 22.x) allows authenticated administrative users to inject arbitrary OS commands via crafted HTTP requests, resulting in unauthenticated remote code execution on the appliance. The vulnerability requires valid administrator credentials as a precondition.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Affected products
Ivanti · ICSIvanti · IPS
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Ivanti ICS

In the same product, most dangerous first.

CVE-2024-21893HIGHCVE-2024-21893EPSS 100.0%KEVCVE-2023-46805HIGHCVE-2023-46805EPSS 100.0%KEVCVE-2024-22024HIGHCVE-2024-22024EPSS 94.7%CVE-2024-21888HIGHCVE-2024-21888EPSS 85.4%