CVE-2024-39710
Published: 13 November 2024
Summary
CVE-2024-39710 is a critical-severity Argument Injection (CWE-88) vulnerability in Ivanti Connect Secure. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 5.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-39710 is an argument injection vulnerability, tracked under CWE-88, that affects Ivanti Connect Secure prior to versions 22.7R2.1 and 9.1R18.7 as well as Ivanti Policy Secure prior to version 22.7R1.1. The flaw carries a CVSS 3.0 base score of 9.1 and resides in the affected appliances' administrative interfaces.
A remote attacker who already possesses valid administrative credentials can supply crafted arguments over the network to trigger remote code execution with high impact on confidentiality, integrity, and availability. Exploitation requires no user interaction and crosses a security boundary, enabling the attacker to run arbitrary commands on the underlying system.
Ivanti's security advisory addresses this issue alongside other CVEs in the same products and directs administrators to apply the listed fixed releases. The associated EPSS score rose from a low baseline to a peak of 0.1910, indicating that exploitation interest increased after public disclosure and that the vulnerability merits renewed monitoring.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38337
Vulnerability details
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.