Critical vulnerabilities in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS)

ASD’s ACSC is aware a patch is now available to address the vulnerabilities.

Please see below advice from Ivanti:

• Ivanti CVE-2024-21887
• Ivanti CVE-2023-46805

ASD’s ACSC is aware of reports that threat actors have developed workarounds to the current mitigation and detection methods, leading to reported ongoing exploitation activity.

ASD’s ACSC strongly advises organisations operating vulnerable Ivanti Connect Secure and Ivanti Policy Secure products to conduct investigation and monitoring for potential compromise of systems. ASD’s ACSC recommends organisations monitor authentication, account usage and identity management services, and consider isolating systems from any enterprise resources as much as possible.

Ivanti has updated their mitigation advice warning Administrators to not push new device configurations to appliances after applying mitigations.

KB CVE-2023-46805 (Authentication Bypass) & CVE-2024-21887 (Command Injection) for Ivanti Connect Secure and Ivanti Policy Secure Gateways

• Ivanti advises customers not to push other configurations to appliances with the mitigation XML in place, until Ivanti releases a complete patch and it is applied.
• When an alternative configuration is pushed to the appliance, it may prevent the mitigation from functioning.
• This applies to customers who push configurations to appliances, including configuration pushes through Pulse One or nSA.
• This can occur regardless of a full or partial configuration push.