- Ivanti Patches Four Bugs found in Connect Secure, Policy Secure and Cloud Services -Aplications
- All four could be used in RCE attack
- Patches are available and users are advised to apply them ASAP
Ivanti has released patches for four vulnerabilities to critical difficulty discovered in a number of its products.
The vulnerabilities are traced as CVE-2024-38657, CVE-2025-22467, CVE-2024-10644 and CVE-2024-47908. All of these got a severity of 9.1/10 (critical). Different bugs affect different solutions including Connect Secure (ICS), Policy Secure (IPS) and Cloud Services Applications (CSA).
Since they can be used for very disturbing cyberattacks, users are advised to use patches without hesitation – and a security advice containing more details about the above deficiencies can be found at this link.
Step stone
All the errors can be used to perform arbitrary code externally. The first clean versions are Ivanti Connect Secure 22.7R2.6, Ivanti Policy Secure 22.7R1.3 and Ivanti CSA 5.0.5, and users are advised to upgrade to these versions immediately.
Ivanti said there is no evidence of abuse of wild. However, the company’s products are quite popular in both businesses and small and medium -sized companies (SMB), and as such are often targeted and used as a first entry point.
“Although these products are not the ultimate target, they are increasingly the route that well-equipped nation-state groups focus on their efforts on trying espionage campaigns against extremely high value systems,” said Daniel Spicer, Ivanti CSO.
“We have improved internal scanning, manual utilization and test capacities, increased collaboration and information sharing with the security ecosystem and further improving our responsible disclosure process, including becoming a CVE numbering authority.”
In late January 2025, US CyberSecurity and Infrastructure Security Agency (CISA) added four Ivanti vulnerable to its known utilized vulnerabilities (KEV) catalog, suggesting that they were abused in nature. Bugs, found in Ivanti Cloud Service Appliance (CSA) and patched in September and October 2024, are used in two attack chains to gain initial access, complete RCE, get credentials and influence of webshells.
Via Hacker the news
