CVE-2024-11633
Published: 10 December 2024
Summary
CVE-2024-11633 is a critical-severity Argument Injection (CWE-88) vulnerability in Ivanti Connect Secure. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 5.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-11633 is an argument injection vulnerability, tracked as CWE-88, that affects Ivanti Connect Secure prior to version 22.7R2.4. The flaw received a CVSS 3.1 base score of 9.1 reflecting network attack vector, low complexity, high-privileged authentication requirements, and impacts across confidentiality, integrity, and availability in a changed scope.
A remote authenticated attacker holding administrative privileges can supply crafted arguments to the affected component and obtain remote code execution on the target appliance.
The vendor advisory published in December 2024 directs customers to upgrade Ivanti Connect Secure (and the related Policy Secure product) to 22.7R2.4 or later to remediate the issue. The EPSS score reached a peak of 0.1922 with a current value of 0.1269.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-34147
Vulnerability details
Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.