by Kastro
Paper/Archive/CVE-2024-7593

CVE-2024-7593

Ivanti vTM — Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

KEV · due 15 OctEPSS 100%public exploitSSVC actCVSS 9.8
critical.is priorityof 100
99
CVSS 9.8 (CNA)9.8 / 10 × 3029.4In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

Affected

ProductAffectedFixed inSource
vTMsee advisory22.7R2CNA
virtual_traffic_manager22.7r1 – < 22.7r222.7r2CISA-ADP
virtual_traffic_manager22.2 – < 22.2r122.2r1CISA-ADP
virtual_traffic_manager22.3 – < 22.3r322.3r3CISA-ADP
virtual_traffic_manager22.3r2 – < 22.3r322.3r3CISA-ADP
virtual_traffic_manager22.6r1 – < 22.6r222.6r2CISA-ADP
virtual_traffic_manager22.5r1 – < 22.5r222.5r2CISA-ADP
virtual_traffic_manager22.7r1 – < 22.7r222.7r2CISA-ADP
virtual_traffic_manager22.2 – < 22.2r122.2r1CISA-ADP
virtual_traffic_manager22.3 – < 22.3r322.3r3CISA-ADP
virtual_traffic_manager22.3r2 – < 22.3r322.3r3CISA-ADP
virtual_traffic_manager22.6r1 – < 22.6r222.6r2CISA-ADP

Scores by source

ivanti (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refforums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-7593kevcisa.gov/known-exploited-vulnerabilities-catalog