{"status":"success","data":{"id":"CVE-2024-21887","slug":"cve-2024-21887-ivanti-connect-secure-command-injection","title":"Ivanti Connect Secure & Policy Secure Command Injection Vulnerability","summary":"Critical command injection flaw in Ivanti Connect Secure VPN gateways allowing unauthenticated remote code execution.","description":"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated administrator or remote attacker to send specially crafted requests and execute arbitrary commands on the appliance. Often chained with CVE-2023-46805 (authentication bypass).","severity":"CRITICAL","cvss_score":9.1,"cvss_version":"3.1","cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_metrics":{"scope":"UNCHANGED","integrity":"HIGH","attackVector":"NETWORK","availability":"HIGH","confidentiality":"HIGH","userInteraction":"NONE","attackComplexity":"LOW","privilegesRequired":"NONE"},"epss_score":0.9995,"epss_percentile":0.9997,"cisa_kev":true,"cisa_date_added":"2024-01-11T00:00:00.000Z","cisa_due_date":"2024-01-22T00:00:00.000Z","ransomware_campaign":"Multiple cybercrime and espionage groups","threat_actors":["UTA0178","Volt Typhoon"],"exploit_status":"active_wild","cwes":[{"id":"CWE-77","name":"Improper Neutralization of Special Elements used in a Command ('Command Injection')"}],"affected_vendors":["Ivanti"],"affected_products":[{"cpe":"cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*","vendor":"Ivanti","product":"Connect Secure (ICS)","fixed_version":"ICS 22.5R2.2 / 22.6R2.1","affected_versions":"9.x, 22.x prior to security patches"}],"ai_analysis":{"sigma_rule":"title: Ivanti Connect Secure Command Injection\nstatus: critical\nlogsource:\n  category: webserver\ndetection:\n  selection:\n    cs-uri-stem|contains: '/api/v1/license/keys-status/'\n  condition: selection","analyzed_at":"2026-10-28T10:00:00.000Z","model_provider":"Gemini 2.0 Flash Security Sentinel","executive_summary":"Widely weaponized enterprise edge device flaw allowing state actors and ransomware affiliates to bypass authentication, plant persistent webshells, and harvest internal network traffic.","detection_guidance":"Examine ICT logs for mismatched files in `/home/etc/manifest/` and unexpected modifications in `/pkg/do/`.","mitigation_playbook":["Apply Ivanti security patches and run the External Integrity Checker Tool (ICT).","Revoke all certificates, API keys, and Active Directory credentials passing through the gateway.","Isolate VPN management interfaces from untrusted external networks."],"technical_root_cause":"The API endpoint `/api/v1/license/keys-status/` fails to sanitize user inputs passed into internal python system exec routines. Chaining with the CVE-2023-46805 path traversal bypass removes all authentication barriers.","exploitation_mechanism":"Adversary issues an HTTP GET to `/api/v1/license/keys-status/;[command]` through the path traversal wrapper. The command runs with root privileges on the FreeBSD underlying operating system.","enterprise_blast_radius":"Total perimeter breach: theft of VPN session tokens, Active Directory credentials, internal subnet pivoting."},"references":[{"url":"https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/","type":"advisory","title":"Volexity Advisory: Zero-Day Exploitation of Ivanti Connect Secure"},{"url":"https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities","type":"cisa","title":"CISA Emergency Directive 24-01"}],"published_at":"2024-01-12T12:00:00.000Z","updated_at":"2026-10-28T18:00:00.000Z"}}