CVE-2024-10644
Published: 11 February 2025
Summary
CVE-2024-10644 is a critical-severity Code Injection (CWE-94) vulnerability in Ivanti Connect Secure. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 8.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the code injection vulnerability by requiring timely identification, reporting, and patching to the fixed Ivanti versions 22.7R2.4 or 22.7R1.3.
Prevents code injection (CWE-94) by enforcing information input validation at the vulnerable interfaces exploited by authenticated admins.
Reduces exploitability by enforcing least privilege, limiting administrative accounts that can perform the remote code execution.
NVD Description
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Deeper analysisAI
CVE-2024-10644 is a code injection vulnerability (CWE-94) affecting Ivanti Connect Secure prior to version 22.7R2.4 and Ivanti Policy Secure prior to version 22.7R1.3. Published on February 11, 2025, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote code execution.
The vulnerability can be exploited by a remote authenticated attacker possessing administrative privileges. Successful exploitation enables remote code execution on the targeted system, with changed scope allowing potential compromise beyond the vulnerable component.
Ivanti's February Security Advisory, available at https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs, addresses this CVE alongside others. Mitigation requires upgrading to Ivanti Connect Secure version 22.7R2.4 or later and Ivanti Policy Secure version 22.7R1.3 or later.
Details
- CWE(s)