Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

← Past incidentsFull incident
ClosedPatched

Day · Jan 10, 2024

Ivanti Connect Secure zero-days chained for mass VPN compromise

Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons

Follow this incident

Updates on Jan 10, 2024

  1. CISA added CVE-2023-46805 to the KEV catalog (federal deadline 2024-01-22)

    Source

  2. CISA added CVE-2024-21887 to the KEV catalog (federal deadline 2024-01-22)

    Source

  3. Volexity discloses active exploitation of two Ivanti Connect Secure zero-days

    Source

Summary

Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.

Read the full incident →

Advisories8

Sponsored

Buy sponsor slot · $149/mo