CVE-2024-39711
Published: 13 November 2024
Summary
CVE-2024-39711 is a critical-severity Argument Injection (CWE-88) vulnerability in Ivanti Connect Secure. Its CVSS base score is 9.1 (Critical).
Operationally, ranked in the top 5.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2024-39711 is an argument injection vulnerability, tracked under CWE-88, that affects Ivanti Connect Secure prior to versions 22.7R2.1 and 9.1R18.7 as well as Ivanti Policy Secure prior to version 22.7R1.1. The flaw permits improper handling of arguments supplied to an underlying command, enabling unauthorized command execution on the affected appliances.
A remote attacker who already possesses administrative credentials can supply crafted arguments over the network to trigger remote code execution with high impact across confidentiality, integrity, and availability. The CVSS 9.1 score reflects the combination of network reachability, low attack complexity, and the requirement for high-privileged authentication.
The referenced Ivanti security advisory details the affected product versions and provides remediation guidance, including upgrades to the fixed releases 22.7R2.1, 9.1R18.7, and 22.7R1.1 respectively.
EPSS for this CVE rose from a low baseline to a peak of 0.1910 before settling at the current value of 0.1241, indicating that exploitation interest increased measurably after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-38338
Vulnerability details
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.