CVE-2024-38656
Published: 13 November 2024
Summary
CVE-2024-38656 is a critical-severity Argument Injection (CWE-88) vulnerability in Ivanti Connect Secure. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 5.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-38656 is an argument injection vulnerability, tracked under CWE-88, that affects Ivanti Connect Secure prior to versions 22.7R2.2 and 9.1R18.9 as well as Ivanti Policy Secure before 22.7R1.2. The flaw received a CVSS 3.1 base score of 9.1, reflecting network attack vector, low complexity, high privileges required, no user interaction, changed scope, and high impact to confidentiality, integrity, and availability.
A remote authenticated attacker holding administrative privileges can supply crafted arguments to the affected components and thereby execute arbitrary code on the target system.
The single referenced Ivanti advisory addresses this issue alongside other CVEs in the same products and identifies the fixed releases that remediate the argument-injection vector.
EPSS for the CVE remains flat at 0.1431 with no material increase after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37717
Vulnerability details
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.