ClosedPatched
Day · Jan 12, 2024
Ivanti Connect Secure zero-days chained for mass VPN compromise
Ivanti Connect Secure and Policy Secure / Connect Secure, Policy Secure, and Neurons
Updates on Jan 12, 2024
Summary
Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.
Read the full incident →Advisories8
- Ivanti KB: CVE-2023-46805 and CVE-2024-21887 for Ivanti Connect Secure and Policy SecureIvanti
- ED 24-01: Mitigate Ivanti Connect Secure and Ivanti Policy Secure vulnerabilitiesCISA · Jan 19, 2024
- Supplemental Direction V1: ED 24-01CISA · Jan 31, 2024
- Ivanti advisory: CVE-2023-46805Ivanti
- NVD: CVE-2023-46805NVD · Jan 12, 2024
- NVD: CVE-2024-21887NVD · Jan 12, 2024
- NVD: CVE-2024-21893NVD · Jan 31, 2024
- CISA Known Exploited Vulnerabilities CatalogCISA · Jan 10, 2024
