Security News > 2024 > April > Ivanti fixes VPN gateway vulnerability allowing RCE, DoS attacks
While Ivanti said the remote code execution risks are limited to "Certain conditions," the company didn't provide details on the vulnerable configurations.
"We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure," Ivanti added.
Shodan, a search engine used to discover Internet-exposed services and devices, currently tracks over 29,000 Ivanti Connect Secure VPN gateways exposed online, while threat monitoring platform Shadowserver sees over 18,000.
Nation-state actors have been exploiting multiple vulnerabilities in Ivanti software this year, and thousands of Ivanti Connect Secure and Policy Secure endpoints are still at risk.
In response, the U.S. Cybersecurity and Infrastructure Security Agency issued an emergency directive to federal agencies ordering them to secure their Ivanti systems against attacks using the zero-day flaws.
The directive was later amended to require agencies to disconnect vulnerable Ivanti VPN appliances and rebuild them with patched software before bringing them back online.
News URL
Related news
- Palo Alto Networks warns of potential PAN-OS RCE vulnerability (source)
- Critical Veeam RCE bug now used in Frag ransomware attacks (source)
- New Flaws in Citrix Virtual Apps Enable RCE Attacks via MSMQ Misconfiguration (source)
- CISA Flags Two Actively Exploited Palo Alto Flaws; New RCE Attack Confirmed (source)
- Palo Alto Networks warns of critical RCE zero-day exploited in attacks (source)
- Critical RCE bug in VMware vCenter Server now exploited in attacks (source)
- D-Link urges users to retire VPN routers impacted by unfixed RCE flaw (source)
- Fortinet VPN design flaw hides successful brute-force attacks (source)
- New NachoVPN attack uses rogue VPN servers to install malicious updates (source)
- VPN vulnerabilities, weak credentials fuel ransomware attacks (source)