Critical Command Injection Vulnerability in Ivanti Connect Secure and Policy Secure

What changed

A significant command injection vulnerability has been identified in Ivanti Connect Secure and Ivanti Policy Secure. This flaw allows authenticated administrators to craft specific requests that can execute arbitrary code on the affected devices.

This vulnerability is particularly concerning as it can be exploited in conjunction with another identified issue, CVE-2023-46805, which allows authenticated bypass, thereby increasing the risk of unauthorized access.

Who is affected

The vulnerability impacts several products and their users, posing a substantial risk to organizations utilizing these systems.

Affected entities include:

• Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure
• Ivanti Policy Secure
• Organizations that rely on these products for secure remote access and policy enforcement
• Administrators managing these systems who may inadvertently expose their environments to exploitation

What to do

Organizations using Ivanti Connect Secure and Policy Secure should take immediate action to mitigate the risks associated with this vulnerability.

It is crucial to monitor for updates from Ivanti and apply any patches or security updates as they become available.

• Review security configurations and access controls for affected systems.
• Implement monitoring to detect unusual activities that could indicate exploitation attempts.
• Educate administrators about the risks and ensure they follow best practices for system management.