Alert: Ivanti Raises Alarm About Active Exploits of Freshly Patched Cloud Appliance Vulnerability
Ivanti has disclosed that a recently patched security loophole in its Cloud Service Appliance (CSA) is currently being actively exploited in the wild.
The significant vulnerability under scrutiny is CVE-2024-8190 (CVSS score: 7.2), which permits remote code execution under specific conditions.
“A weakness in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and earlier allows a remote authenticated attacker to achieve remote code execution,” Ivanti highlighted in an advisory released earlier this week. “The attacker must possess admin level privileges to leverage this vulnerability.”
The flaw affects Ivanti CSA 4.6, which has now reached its end-of-life phase, necessitating customers to upgrade to a supported version moving forward. Nevertheless, it has been fixed in CSA 4.6 Patch 519.
“Given its end-of-life status, this is the final patch that Ivanti will retroactively apply to this version,” the IT software company headquartered in Utah added. “Customers are required to transition to Ivanti CSA 5.0 for ongoing support.”
“CSA 5.0 is the sole version that is supported and does not feature this vulnerability. Existing customers on Ivanti CSA 5.0 are not obliged to take any further action.”
Last Friday, Ivanti revised its advisory to indicate that it had identified confirmed exploitation of the loophole in the wild concentrating on a “limited set of customers.”
It refrained from disclosing additional specifics regarding the attacks or the identity of the threat actors who are employing it, nevertheless, several other vulnerabilities in Ivanti products have been leveraged as zero-days by Chinese-affiliated cyber espionage factions.
This development has spurred the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to incorporate the shortfall in its Known Exploited Vulnerabilities (KEV) catalog, necessitating federal agencies to apply the remedies by October 4, 2024.
The disclosure comes amidst cybersecurity firm Horizon3.ai publishing an extensive technical breakdown of a critical deserialization vulnerability (CVE-2024-29847, CVSS score: 10.0) affecting Endpoint Manager (EPM) that leads to remote code execution.
About Author
