Cyber Security News

Ivanti Warns of Critical Vulnerabilities in Connect Secure, Policy Secure & Secure Access

Ivanti, the well-known provider of IT asset and service management solutions, has issued critical security updates for its products Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC).

These updates address multiple vulnerabilities, including medium, high, and critical severity issues, which, if exploited, could lead to denial of service (DoS), privilege escalation, and even remote code execution (RCE).

The company urges users to apply the patches immediately, though it reassures that there are currently no known cases of active exploitation of these vulnerabilities in the wild.

Summary of Vulnerabilities

Ivanti has identified and patched a wide range of vulnerabilities affecting its products, including stack-based buffer overflows, use-after-free bugs, command injections, and incorrect file permissions.

Free Ultimate Continuous Security Monitoring Guide - Download Here (PDF)

Some of the most severe vulnerabilities could allow attackers to gain administrative privileges or execute arbitrary code on affected systems.

Below is a detailed list of the vulnerabilities, along with their CVE numbers, descriptions, CVSS scores, and the affected products.


CVE Number
DescriptionCVSS Score (Severity)Impacted Product(s)
CVE-2024-38655Argument injection allowing a remote authenticated attacker with admin privileges to achieve remote code execution.9.1 (Critical)Connect Secure & Policy Secure
CVE-2024-38656Argument injection allowing a remote authenticated attacker with admin privileges to achieve RCE in older versions.9.1 (Critical)Connect Secure & Policy Secure
CVE-2024-39710Argument injection enabling RCE by remote authenticated admin attackers.9.1 (Critical)Connect Secure & Policy Secure
CVE-2024-11007Command injection allowing a remote authenticated attacker with admin privileges to execute arbitrary commands on the system.9.1 (Critical)Connect Secure & Policy Secure
CVE-2024-11006Command injection allowing RCE via remote admin attackers in vulnerable versions.9.1 (Critical)Connect Secure & Policy Secure
CVE-2024-11005Command injection allowing RCE by remote admin attackers.9.1 (Critical)Connect Secure & Policy Secure

Affected Versions and Patch Availability

Ivanti has released patches to address all identified vulnerabilities. The following table outlines the affected versions and the corresponding resolved versions:

Product NameAffected Version(s)Resolved Version(s)Patch Availability
Ivanti Connect Secure (ICS)22.7R2.2 and prior22.7R2.3Ivanti Portal
Ivanti Policy Secure (IPS)22.7R1.1 and prior22.7R1.2Ivanti Portal
Ivanti Secure Access Client (ISAC)22.7R3 and prior22.7R4Ivanti Portal

Ivanti recommends that users of the affected products immediately update their systems to the latest patched versions to mitigate the risk of exploitation.

Ivanti customers can download the patches from the Ivanti support portal. Given the critical nature of some of these vulnerabilities, particularly the risk of remote code execution, administrators need to prioritize these updates and ensure their environments are secured.

Run private, Real-time Malware Analysis in both Windows & Linux VMs. Get a 14-day free trial with ANY.RUN!

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Fake BSOD Attack Launched via Malicious Python Script

A peculiar malicious Python script has surfaced, employing an unusual and amusing anti-analysis trick to…

1 day ago

SocGholish Malware Dropped from Hacked Web Pages using Weaponized ZIP Files

A recent wave of cyberattacks leveraging the SocGholish malware framework has been observed using compromised…

1 day ago

Lazarus Group Targets Developers Worldwide with New Malware Tactic

North Korea's Lazarus Group, a state-sponsored cybercriminal organization, has launched a sophisticated global campaign targeting…

1 day ago

North Korean IT Workers Penetrate Global Firms to Install System Backdoors

In a concerning escalation of cyber threats, North Korean IT operatives have infiltrated global companies,…

1 day ago

REF7707 Hackers Target Windows & Linux Systems with FINALDRAFT Malware

Elastic Security Labs has uncovered a sophisticated cyber-espionage campaign, tracked as REF7707, targeting entities across…

1 day ago

NVIDIA Container Toolkit Vulnerable to Code Execution Attacks

NVIDIA has issued a critical security update to address a high-severity vulnerability discovered in the…

1 day ago