Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Ivanti Warns of Second CSA Vulnerability Exploited in Attacks

In addition to the Ivanti CSA flaw CVE-2024-8190, another vulnerability affecting the same product, tracked as CVE-2024-8963, has been exploited.

Ivanti vulnerability

A second Ivanti Cloud Services Appliance (CSA) vulnerability has been exploited in attacks, the company announced on Thursday.

On September 10, Ivanti announced that CSA updates patched CVE-2024-8190, a high-severity OS command injection issue that allows unauthorized access to devices. The flaw can be exploited for remote code execution, but it requires authentication with admin-level privileges. 

On September 13, the IT and security solutions provider announced that it had become aware of exploitation of CVE-2024-8190 against a limited number of customers.

On September 19, Ivanti published a new advisory to inform customers that a new vulnerability incidentally addressed with the September 10 patches, tracked as CVE-2024-8963, has also been exploited in attacks. 

“If CVE-2024-8963 is used in conjunction with CVE-2024-8190 an attacker can bypass admin authentication and execute arbitrary commands on the appliance,” Ivanti explained. “We are aware of a limited number of customers who have been exploited by this vulnerability.”  

SecurityWeek noted when Ivanti announced in-the-wild exploitation of CVE-2024-8190 that the flaw has likely been leveraged alongside another flaw, considering that its exploitation requires admin privileges.

CVE-2024-8963 has been described as a critical path traversal issue in the CSA product that allows a remote, unauthenticated attacker to access restricted functionality. 

CSA 4.6 Patch 519 and CSA 5.0 address the vulnerability. However, version 4.6 has reached end of life and this is the last update it will receive, therefore users should upgrade the product to version 5.0. 

Advertisement. Scroll to continue reading.

CISA has added CVE-2024-8963 to its Known Exploited Vulnerabilities Catalog, instructing federal agencies to address it by October 10. 

There does not appear to be any public information on the attacks involving the exploitation of CVE-2024-8963 and CVE-2024-8190.

It’s not uncommon for threat actors to exploit Ivanti product vulnerabilities, including for backdoor delivery and to hack high-profile organizations such as MITRE and CISA.  

Related: MITRE Hack: China-Linked Group Breached Systems in December 2023

Related: Governments Urge Organizations to Hunt for Ivanti VPN Attacks

Related: Chinese Cyberspies Use New Malware in Ivanti VPN Attacks

Written By

Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Don’t miss this Live Attack demonstration to learn how hackers operate and gain the knowledge to strengthen your defenses.

Register

Join us as we share best practices for uncovering risks and determining next steps when vetting external resources, implementing solutions, and procuring post-installation support.

Register

People on the Move

Mike Byron has been named Chief Financial Officer (CFO) at Exabeam.

Ex-GitHub chief technology officer Mike Hanley has joined GM as CISO.

Network security and compliance assurance firm Titania has appointed Victoria Dimmick as CEO.

More People On The Move

Expert Insights

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest cybersecurity news, threats, and expert insights. Unsubscribe at any time.