PT-2024-39620 · Ivanti · Ivanti Policy Secure+1

Published 2024-11-12 · Updated 2025-01-17 · CVE-2024-9420

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.3 Ivanti Policy Secure versions prior to 22.7R1.2

Description A use-after-free issue allows a remote authenticated attacker to achieve remote code execution. This can potentially allow hackers to take control of systems through this flaw.

Recommendations For Ivanti Connect Secure versions prior to 22.7R2.3, update to version 22.7R2.3 or later. For Ivanti Policy Secure versions prior to 22.7R1.2, update to version 22.7R1.2 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

CVE-2024-9420

Affected Products

Ivanti Connect Secure

Ivanti Policy Secure

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-9420 · Security Note
• https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-9420 · Vendor Advisory
• https://twitter.com/CveFindCom/status/1856374305451352079 · Twitter Post
• https://twitter.com/AbuseAE/status/1856402429677617477 · Twitter Post
• https://twitter.com/CVEnew/status/1856371547633586439 · Twitter Post
• https://t.me/cvedetector/10638 · Telegram Post