CVE-2024-21887
Ivanti ICS
Summary
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the ap…
Published: 2024-01-12
Analysis
🟠 High — imminent exploitation
Weakness: Command Injection (CWE-77). Runs commands via unsanitized input.
How it's exploited: Exploitable over the network (internet-reachable), with high privileges, no user interaction, and with low complexity. The flaw can pivot to other components (scope changed).
Impact: Full compromise (confidentiality, integrity and availability).
Status: Exploit probability (EPSS, 30 days): 100% — high.
- Apply the vendor patch according to risk priority.
- Reduce exposure: keep it off the internet; firewall, VPN or network segmentation.
- Detect: turn this CVE into detection rules.
MITRE ATT&CK technique: T1190 · Exploit Public-Facing Application · T1059 · Command and Scripting Interpreter
Practice it in the arsenal: WAF Bypass · PowerShell Decoder · Reverse Shells
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
The vector encodes how it's exploited (translated above, in the analysis). Break it down in the CVSS tool →
Sources: CISA KEV · EPSS · FIRST.org · NVD. Analysis derived from the CVSS vector and exploitation status (no AI). Informational; always verify against the vendor's official advisory.