CVE-2024-9420
Published: 12 November 2024
Summary
CVE-2024-9420 is a high-severity Use After Free (CWE-416) vulnerability in Ivanti Connect Secure. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
A use-after-free vulnerability tracked as CVE-2024-9420 affects Ivanti Connect Secure prior to versions 22.7R2.3 and 9.1R18.9 as well as Ivanti Policy Secure prior to version 22.7R1.2. The flaw, assigned CWE-416, carries a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, and low required privileges.
A remote authenticated attacker can trigger the use-after-free condition to achieve remote code execution on the affected appliances. The attack requires no user interaction and can result in full compromise of confidentiality, integrity, and availability.
The referenced Ivanti security advisory addresses this issue along with additional CVEs and supplies the corresponding patched releases for both Connect Secure and Policy Secure products.
EPSS for the vulnerability rose from a low baseline to a peak of 0.2906 on 2025-12-11 before receding to the current value of 0.1864, indicating that exploitation interest increased after public disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-50308
Vulnerability details
A use-after-free in Ivanti Connect Secure before version 22.7R2.3 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker to achieve remote code execution
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Use-after-free exploits that achieve arbitrary code execution are blocked or significantly hardened by non-executable pages and ASLR.