CVE-2024-7593criticalunder attackCWE-287CWE-303

CVE-2024-7593: critical vulnerability in Ivanti vTM

Published · Updated

Follow this CVE+ Monitor Virtual Traffic Manager+ Monitor vTM

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weapon15 days
Published on NVDAug 13
1st PoC+15d
metasploitAug 5
CISA KEV+42d
Action required by CISAfederal deadline: 2024-10-15

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Ivanti vTM versions other than 22.2R1 or 22.7R2 have a flawed authentication system that allows attackers to access the admin panel without valid credentials. This is critical because it gives complete control of the system to unauthorized users.

Technical detail

The authentication algorithm in Ivanti vTM is incorrectly implemented (CWE-287), enabling remote attackers to bypass authentication controls (CWE-303) without pre-authentication. An unauthenticated threat actor can gain unauthorized access to the admin panel, resulting in full system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
Ivanti · vTM
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.