Hardcoded Key Vulnerability in Ivanti Connect Secure and Policy Secure Products
CVE-2024-13842

4.4MEDIUM

Key Information:

Vendor
Ivanti
Status
Connect Secure
Policy Secure
Vendor
CVE Published:
11 February 2025

Summary

A vulnerability exists in Ivanti Connect Secure and Ivanti Policy Secure due to a hardcoded key, which allows a local authenticated attacker with admin privileges to access and read sensitive data. This could lead to unauthorized information disclosure and pose serious risks to user privacy and data security. Organizations using these products are advised to review their configurations and promptly update to versions that mitigate this issue.

Affected Version(s)

Connect Secure 22.7R2.3

Policy Secure 22.7R1.3

References

https://forums.ivanti.com/s/article/February-Security-Adv...

CVSS V3.1

Score:
4.4
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.