Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Network Security

Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability

Researchers at the Shadowserver Foundation identify thousands of internet-exposed Ivanti VPN appliances likely impacted by a recently disclosed vulnerability leading to remote code execution.

Researchers at the Shadowserver Foundation have identified thousands of internet-exposed Ivanti VPN appliances likely impacted by a recently disclosed vulnerability leading to remote code execution.

The vulnerability, tracked as CVE-2024-21894 (CVSS 8.2), is described as a heap overflow bug in the IPSec component of Ivanti Connect Secure (formerly Pulse Connect Secure) and Policy Secure that could be exploited by remote, unauthenticated attackers to cause a denial-of-service (DoS) condition or execute arbitrary code.

On April 2, Ivanti released software updates to address this flaw and three other vulnerabilities in its two VPN appliances, including CVE-2024-22053, another high-severity heap overflow bug leading to DoS.

The issue impact all supported versions of Connect Secure and Policy Secure and Ivanti has urged all users to update their instances, albeit noting that it was not aware of these bugs being exploited at the time of disclosure. 

On Friday, ShadowServer, which is conducting daily internet scans to identify vulnerable and exploited appliances, said it had identified over 16,000 Ivanti VPN instances potentially impacted by CVE-2024-21894.

As of April 7, ShadowServer data shows roughly 10,000 internet-accessible Ivanti Connect Secure and Policy Secure instances vulnerable to CVE-2024-21894.

Most of the appliances are in the US (3,700) and Japan (1,700), followed by the UK (860), France (710), Germany (570), China (440), Canada (300), and India (290).

What is unclear, however, is how many of these are actual Ivanti VPNs or honeypots and whether the decrease in observed instances was caused by patching.

Advertisement. Scroll to continue reading.

Ivanti has found itself reeling from a spate of zero-day attacks that recently threw its security response teams into disarray and forced the US government to issue disconnection instructions. The company says it is now embarking on a makeover of the entire cybersecurity organization.

Related: Ivanti CEO Vows Security Makeover After Zero-Day Blitz

Related: Ivanti Patches Critical Flaws in Standalone Sentry, Neurons for ITSM

Related: Governments Urge Organizations to Hunt for Ivanti VPN Attacks

Related: Chinese Cyberspies Use New Malware in Ivanti VPN Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Trending

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.

Register

The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders.

Register

People on the Move

Fastly announced that Scott Lovett will join the company as Chief Revenue Officer, effective June 3, 2024.

Digital transformation consulting firm Synechron has hired Aaron Momin as CISO.

Wendy Zheng named as CFO and Joe Diamond as CMO at cyber asset management firm Axonius.

More People On The Move

Expert Insights