Ivanti Connect Secure and Ivanti Policy Secure Multiple Vulnerabilities
Ivanti Connect Secure and Ivanti Policy Secure contain multiple vulnerabilities that allow a remote, authenticated attacker to execute arbitrary code. All of the vulnerabilities except for CVE-2024-39709 require the attacker to be authenticated with administrative privileges to the administrative web interface. CVE-2024-39709 requires the attacker to have 'nr' privileges on the underlying Linux operating system. These vulnerabilities are addressed in Ivanti Connect Secure versions 22.6R2, 22.7R2.1, and 9.1R18.7 and Ivanti Policy Secure versions 22.7R1.1 and 22.7R1.2.
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2024-39712US | — | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-39711US | — | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-39710US | — | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-39709US | —OT elevated | — | ||
Incorrect file permissions in Ivanti Connect Secure before version 22.6R2 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1 (Not Applicable to 9.1Rx) allow a… | ||||
| CVE-2024-38656US | — | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin… | ||||
| CVE-2024-38655US | high7.2 | — | ||
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacke… | ||||
references
External citations — patches, advisories, analysis.
remediations (12)
- FixedConnect Secure
Upgrade Ivanti Connect Secure to version 22.6R2.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedConnect Secure
Upgrade Ivanti Connect Secure to version 22.7R2.2.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.1.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - FixedPolicy Secure
Upgrade Ivanti Policy Secure to version 22.7R1.2.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan