Researchers at the Shadowserver Foundation have identified thousands of internet-exposed Ivanti VPN appliances likely impacted by a recently disclosed vulnerability leading to remote code execution.
The vulnerability, tracked as CVE-2024-21894 (CVSS 8.2), is described as a heap overflow bug in the IPSec component of Ivanti Connect Secure (formerly Pulse Connect Secure) and Policy Secure that could be exploited by remote, unauthenticated attackers to cause a denial-of-service (DoS) condition or execute arbitrary code.
On April 2, Ivanti released software updates to address this flaw and three other vulnerabilities in its two VPN appliances, including CVE-2024-22053, another high-severity heap overflow bug leading to DoS.
The issue impact all supported versions of Connect Secure and Policy Secure and Ivanti has urged all users to update their instances, albeit noting that it was not aware of these bugs being exploited at the time of disclosure.
On Friday, ShadowServer, which is conducting daily internet scans to identify vulnerable and exploited appliances, said it had identified over 16,000 Ivanti VPN instances potentially impacted by CVE-2024-21894.
As of April 7, ShadowServer data shows roughly 10,000 internet-accessible Ivanti Connect Secure and Policy Secure instances vulnerable to CVE-2024-21894.
Most of the appliances are in the US (3,700) and Japan (1,700), followed by the UK (860), France (710), Germany (570), China (440), Canada (300), and India (290).
What is unclear, however, is how many of these are actual Ivanti VPNs or honeypots and whether the decrease in observed instances was caused by patching.
Ivanti has found itself reeling from a spate of zero-day attacks that recently threw its security response teams into disarray and forced the US government to issue disconnection instructions. The company says it is now embarking on a makeover of the entire cybersecurity organization.
Related: Ivanti CEO Vows Security Makeover After Zero-Day Blitz
Related: Ivanti Patches Critical Flaws in Standalone Sentry, Neurons for ITSM
Related: Governments Urge Organizations to Hunt for Ivanti VPN Attacks
Related: Chinese Cyberspies Use New Malware in Ivanti VPN Attacks
