CVE-2024-38655
Published: 13 November 2024
Summary
CVE-2024-38655 is a high-severity Argument Injection (CWE-88) vulnerability in Ivanti Connect Secure. Its CVSS base score is 7.2 (High).
Operationally, ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
The vulnerability is an argument injection issue, tracked as CWE-88, that affects Ivanti Connect Secure prior to versions 22.7R2.1 and 9.1R18.9 as well as Ivanti Policy Secure prior to versions 22.7R1.1 and 9.1R18.9. It received a CVSS 3.1 score of 7.2 reflecting network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability when successfully exploited.
A remote attacker who already possesses authenticated administrative credentials can supply crafted arguments to the affected components, resulting in arbitrary code execution on the appliance. No user interaction is required, and the attack can be launched over the network.
Ivanti’s security advisory recommends immediate upgrade to the fixed releases listed above and provides additional hardening guidance for organizations unable to patch promptly. The EPSS score has remained flat at 0.1828 since disclosure, indicating no material increase in observed exploitation interest to date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37701
Vulnerability details
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.