Flash Alert - Vulnerabilities reported in Ivanti ICS, Ivanti Policy Secure and Citrix NetScaler
SOS Intelligence
Dark Web Monitoring toolkit for business and enterprise. Managed Threat Intelligence services and data-breach alerts.
Hello there,
In the past week, the following vulnerabilities have been disclosed, affecting:
Ivanti ICS & Ivanti Policy Secure
CVSS: 8.2 HIGH
CVSS: 9.1 CRITICAL
Ivanti has disclosed the existence of two significant vulnerabilities affecting their Connect Secure and Policy Secure gateways, specifically versions 9.x and 22.x.
CVE-2023-46805 is an authentication bypass vulnerability, which allows a threat actor to remotely access restricted resources by bypassing control checks.? CVE-2024-21887 is a command injection vulnerability, granting an authenticated user the ability to send specially crafted requests and execute arbitrary commands on the vulnerable device.
When utilised together, a threat actor can compromise a vulnerable device and execute code with admin rights, leaving the victim company open to a significant risk of network intrusion and further criminal activity.
Palo Alto’s Unit 42 has observed over 30,000 vulnerable devices spread across 141 countries. It is actively responding to incidents involving these vulnerabilities, highlighting their use by threat actors in the wild.
Ivanti is currently working on patches to fix these vulnerabilities.? In the meantime, it is recommended that the mitigations they have suggested are implemented to avoid unnecessary risk.? These can be found here.
Citrix NetScaler ADC & Citrix NetScaler Gateway
CVSS: 5.5 MEDIUM
领英推荐
CVSS: 8.2 HIGH
Citrix has identified and disclosed further vulnerabilities in its NetScaler ADC and NetScaler Gateway products.? The following supported versions are affected:
*NetScaler ADC and NetScaler Gateway version 12.1 is now End Of Life (EOL) and is vulnerable
CVE-2023-6548 allows a threat actor authenticated, low-privileged access to remotely execute code on the management interface of a compromised device.? This requires them to have access to the NSIP, CLIP or SNIP which itself has management interface access.
CVE-2023-6549 applies to appliances configured as one of the following:
Exploitation of this vulnerability involves a threat actor restricting operations within the memory buffer, thereby causing an unauthenticated Denial of Service attack.
A patch will follow in due course, but in the meantime, Citrix recommends the following:
Citrix has noted that these vulnerabilities have been observed in the wild and targeted by threat actors.
Stay safe,
Daniel Collyer
Threat Intelligence Analyst
SOS Intelligence Limited
City Point One Ropemaker Street London EC2Y 9AW