Summary
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue.
- Vendor
- Ivanti
- Product
- Connect Secure and Policy Secure
- Added to KEV
- Jan 10, 2024
- Remediation due
- Jan 22, 2024 (US federal deadline)
- Ransomware use
- Known
- Weakness
- CWE-77
- EPSS
- 100.0% as of Nov 10
In the news · last mention Oct 15
Linked
Actors named alongside it:
Incidents exploiting it:
References