Security News > 2024 > April > Ivanti fixes VPN gateway vulnerability allowing RCE, DoS attacks
While Ivanti said the remote code execution risks are limited to "Certain conditions," the company didn't provide details on the vulnerable configurations.
"We are not aware of any customers being exploited by these vulnerabilities at the time of disclosure," Ivanti added.
Shodan, a search engine used to discover Internet-exposed services and devices, currently tracks over 29,000 Ivanti Connect Secure VPN gateways exposed online, while threat monitoring platform Shadowserver sees over 18,000.
Nation-state actors have been exploiting multiple vulnerabilities in Ivanti software this year, and thousands of Ivanti Connect Secure and Policy Secure endpoints are still at risk.
In response, the U.S. Cybersecurity and Infrastructure Security Agency issued an emergency directive to federal agencies ordering them to secure their Ivanti systems against attacks using the zero-day flaws.
The directive was later amended to require agencies to disconnect vulnerable Ivanti VPN appliances and rebuild them with patched software before bringing them back online.
News URL
Related news
- Zero-Day Vulnerability in Ivanti VPN (source)
- Mirai Botnet Variant Exploits Four-Faith Router Vulnerability for DDoS Attacks (source)
- Ivanti warns of new Connect Secure flaw used in zero-day attacks (source)
- Ivanti zero-day attacks infected devices with custom malware (source)
- Hackers exploit critical Aviatrix Controller RCE flaw in attacks (source)
- Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks (source)
- PlushDaemon APT Targets South Korean VPN Provider in Supply Chain Attack (source)
- IPany VPN breached in supply-chain attack to push custom malware (source)
- Stealthy 'Magic Packet' malware targets Juniper VPN gateways (source)
- SonicWall warns of SMA1000 RCE flaw exploited in zero-day attacks (source)