Remote Code Execution Vulnerability in Ivanti Cloud Services Appliance
Key Information
- Vendor
- Ivanti
- Status
- Csa (cloud Services Appliance)
- Vendor
- CVE Published:
- 10 September 2024
Badges
Summary
CVE-2024-8190 is a remote code execution vulnerability in Ivanti Cloud Services Appliance, with an impact on versions 4.6 Patch 518 and earlier. This vulnerability allows a remote attacker with admin privileges to achieve remote code execution on the device. The Cybersecurity and Infrastructure Security Agency (CISA) has warned that the vulnerability is being actively exploited in the wild and has been added to the known exploited vulnerabilities (KEV) list. It is advised that organizations using impacted versions of the appliance update to CSA 5.0, as it does not contain this vulnerability. While the vulnerability has only been confirmed to affect a limited number of customers, federal civilian agencies are required to address the issue within 60 days of being added to the KEV list. Additionally, Ivanti has confirmed that the high-severity flaw was exploited after public disclosure. It is also important to note that other Ivanti products, such as Endpoint Manager and Workspace Control, have also been affected by critical and high-severity vulnerabilities. Organizations are urged to prioritize patching to ensure their systems are protected.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-8190 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.
Affected Version(s)
CSA (Cloud Services Appliance) <= 4.6 Patch 519
CSA (Cloud Services Appliance) >= 4.6 Patch 519
CSA (Cloud Services Appliance) >= 5.0
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Ivanti Warns of Second CSA Vulnerability Exploited in Attacks
In addition to the Ivanti CSA flaw CVE-2024-8190, another vulnerability affecting the same product, CVE-2024-8963, has been exploited.
2 months ago
PoC exploit for exploited Ivanti Cloud Services Appliance flaw released (CVE-2024-8190) - Help Net Security
CVE-2024-8190, an OS command injection vulnerability in Ivanti Cloud Services Appliance (CSA) v4.6, is under active exploitation.
2 months ago
CISA warns of hackers exploiting bug for end-of-life Ivanti product
Ivanti's Cloud Service Appliance has a "high severity vulnerability" being exploited in the wild.
2 months ago
EPSS Score
12% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
Vulnerability started trending.
- ๐พ
Exploit exists.
First article discovered by CSO Online
Risk change from: null to: 7.2 - (HIGH)
Vulnerability published.