Remote Code Execution Vulnerability in Ivanti Cloud Services Appliance

CVE-2024-8190
7.2HIGH

Key Information

Vendor
Ivanti
Status
Csa (cloud Services Appliance)
Vendor
CVE Published:
10 September 2024

Badges

😄 Trended👾 Exploit Exists🔴 Public PoC📰 News Worthy

Summary

CVE-2024-8190 is a remote code execution vulnerability in Ivanti Cloud Services Appliance, with an impact on versions 4.6 Patch 518 and earlier. This vulnerability allows a remote attacker with admin privileges to achieve remote code execution on the device. The Cybersecurity and Infrastructure Security Agency (CISA) has warned that the vulnerability is being actively exploited in the wild and has been added to the known exploited vulnerabilities (KEV) list. It is advised that organizations using impacted versions of the appliance update to CSA 5.0, as it does not contain this vulnerability. While the vulnerability has only been confirmed to affect a limited number of customers, federal civilian agencies are required to address the issue within 60 days of being added to the KEV list. Additionally, Ivanti has confirmed that the high-severity flaw was exploited after public disclosure. It is also important to note that other Ivanti products, such as Endpoint Manager and Workspace Control, have also been affected by critical and high-severity vulnerabilities. Organizations are urged to prioritize patching to ensure their systems are protected.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-8190 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.

Affected Version(s)

CSA (Cloud Services Appliance) <= 4.6 Patch 519

CSA (Cloud Services Appliance) >= 4.6 Patch 519

CSA (Cloud Services Appliance) >= 5.0

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-8190
Created by horizon3ai

News Articles

favicon imageHelp Net Security

PoC exploit for exploited Ivanti Cloud Services Appliance flaw released (CVE-2024-8190) - Help Net Security

CVE-2024-8190, an OS command injection vulnerability in Ivanti Cloud Services Appliance (CSA) v4.6, is under active exploitation.

3 days ago

favicon imageCyberScoop

CISA warns of hackers exploiting bug for end-of-life Ivanti product

Ivanti's Cloud Service Appliance has a "high severity vulnerability" being exploited in the wild.

6 days ago

favicon imageCSO Online

Newly patched Ivanti CSA flaw under active exploitation

The Cloud Service Appliance command injection vulnerability — patched as part of the final update for end-of-life CSA version 4.6 — has been attacked in the wild, Ivanti confirms.

1 week ago

EPSS Score

15% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability started trending.

  • 👾

    Exploit exists.

  • First article discovered by CSO Online

  • Risk change from: null to: 7.2 - (HIGH)

  • Vulnerability published.

Collectors

NVD DatabaseMitre DatabaseCISA Database1 Proof of Concept(s)3 News Article(s)
.