https://pwn.watch/t/ivanti-connect-secure Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 31 Jan 2024 00:00:00 GMT https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893 https://pwn.watch/i/ivanti-connect-secure-zero-days-cve-2023-46805-cve-2024-21887-21893 Wed, 31 Jan 2024 00:00:00 GMT critical <p>Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory linked in sources</p> <p><strong>Latest updates:</strong></p><ul><li>2024-01-31: CVE-2024-21893 published (<a href="https://nvd.nist.gov/vuln/detail/CVE-2024-21893">source</a>)</li><li>2024-01-31: CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02) (<a href="https://www.cisa.gov/known-exploited-vulnerabilities-catalog">source</a>)</li><li>2024-01-31: CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02 (<a href="https://www.cisa.gov/news-events/directives/supplemental-direction-v1-ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-46805, CVE-2024-21887, CVE-2024-21893</p>