by Kastro
Paper/Archive/CVE-2024-21887

CVE-2024-21887

Ivanti ICS — Ivanti Connect Secure and Policy Secure Command Injection Vulnerability

KEV · due 22 Janransomware useEPSS 100%public exploitSSVC actCVSS 9.1
critical.is priorityof 100
97
CVSS 9.1 (CNA)9.1 / 10 × 3027.3In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Affected

ProductAffectedFixed inSource
ICS9.1R18 – 9.1R18–CNA
ICS22.6R2 – 22.6R2–CNA
IPS9.1R18 – 9.1R18–CNA
IPS22.6R1 – 22.6R1–CNA

Scores by source

hackerone (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refforums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_USrefpacketstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.htmlrefcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-21887kevcisa.gov/known-exploited-vulnerabilities-catalog