Vulnerabilities > CVE-2024-13842 - Use of Hard-coded Cryptographic Key vulnerability in Ivanti Connect Secure 22.7/7.1/7.4

047910
CVSS 4.4 - MEDIUM
Attack vector
LOCAL
Attack complexity
LOW
Privileges required
HIGH
Confidentiality impact
HIGH
Integrity impact
NONE
Availability impact
NONE
local
low complexity
ivanti
CWE-321
NVD
Published: 2025-02-11
Updated: 2025-02-20

Summary

A hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local authenticated attacker with admin privileges to read sensitive data.

Vulnerable Configurations

Part Description Count
Application
Ivanti
300

Common Weakness Enumeration (CWE)

References