pwn.watch: VPN incident updates

[critical] Ivanti Connect Secure zero-day exploited since mid-December 2024 (CVE-2025-0282)

Wed, 08 Jan 2025 00:00:00 GMT

An unauthenticated stack buffer overflow in Ivanti Connect Secure allowed remote code execution. Mandiant saw zero-day exploitation from mid-December 2024 and SPAWN-family malware (SPAWNANT, SPAWNMOLE, SPAWNSNAIL). CISA advised factory-resetting compromised appliances before restoring them on 22.7R2.5 or later.

Status: closed · Patch: patched · Fixed in: Connect Secure 22.7R2.5

Latest updates:

2025-01-08: Ivanti discloses CVE-2025-0282 and ships Connect Secure 22.7R2.5 (source)
2025-01-08: Mandiant reports zero-day exploitation since mid-December 2024 with SPAWN malware (source)
2025-01-08: CISA adds CVE-2025-0282 to KEV and publishes mitigation instructions (source)

CVEs: CVE-2025-0282

[high] Check Point VPN gateway arbitrary file read (CVE-2024-24919) exploited

Thu, 30 May 2024 00:00:00 GMT

Check Point Quantum Security Gateways contain an unspecified information disclosure vulnerability. The vulnerability potentially allows an attacker to access information on Gateways connected to the internet, with IPSec VPN, Remote Access VPN or Mobile Access enabled. This issue affects several product lines from Check Point, including CloudGuard Network, Quantum Scalable Chassis, Quantum Security Gateways, and Quantum Spark Appliances. Added to the CISA KEV catalog on 2024-05-30. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-05-30: CISA added CVE-2024-24919 to the KEV catalog (federal deadline 2024-06-20) (source)
2024-05-28: CVE-2024-24919 published (source)

CVEs: CVE-2024-24919

[critical] Palo Alto PAN-OS GlobalProtect zero-day (CVE-2024-3400)

Fri, 12 Apr 2024 00:00:00 GMT

A command injection in the GlobalProtect feature of PAN-OS let unauthenticated attackers run code as root on Palo Alto firewalls (CVSS 10). Volexity caught an actor it tracks as UTA0218, assessed as likely state-backed, exploiting it as a zero-day, and Palo Alto's Unit 42 tracked the activity as Operation MidnightEclipse. Hotfixes shipped from mid-April 2024. Added to the CISA KEV catalog on 2024-04-12. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: Hotfix releases per the Palo Alto advisory, e.g. 10.2.9-h1, 11.0.4-h1, 11.1.2-h3

Latest updates:

2024-04-12: CVE-2024-3400 published (source)
2024-04-12: CISA added CVE-2024-3400 to the KEV catalog (federal deadline 2024-04-19) (source)
2024-04-12: Palo Alto publishes the advisory; Volexity and Unit 42 publish exploitation details (source)

CVEs: CVE-2024-3400

[critical] Ivanti Connect Secure zero-days chained for mass VPN compromise

Wed, 31 Jan 2024 00:00:00 GMT

Two Ivanti Connect Secure and Policy Secure zero-days, an authentication bypass (CVE-2023-46805) and a command injection (CVE-2024-21887), were chained for unauthenticated remote code execution on internet-facing VPN gateways. Volexity found them in the wild in December 2023 and disclosed them on 2024-01-10. A third bug, an SSRF in the SAML component (CVE-2024-21893), was exploited later in January. CISA issued Emergency Directive 24-01 and then ordered federal agencies to disconnect all Ivanti Connect Secure and Policy Secure appliances. Added to the CISA KEV catalog on 2024-01-10, 2024-01-31. CISA lists known use in ransomware campaigns.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2024-01-31: CVE-2024-21893 published (source)
2024-01-31: CISA added CVE-2024-21893 to the KEV catalog (federal deadline 2024-02-02) (source)
2024-01-31: CISA Supplemental Direction V1: federal agencies must disconnect all Ivanti Connect Secure and Policy Secure instances by 2024-02-02 (source)

CVEs: CVE-2023-46805, CVE-2024-21887, CVE-2024-21893