⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Due date: 2024-01-22.

CVE-2024-21887Ivanti Connect Secure: Command Injection in Ivanti Connect Secure

CWE-77Command Injection35 documents18 sources
Severity
9.1CRITICALNVD
VulnCheck8.2CISA8.2
EPSS
94.4%
top 0.02%
CISA KEV
KEVRansomware
Added 2024-01-10
Due 2024-01-22
Exploit
Exploited in wild
Active exploitation observed
Timeline
KEV addedJan 10
PublishedJan 12
KEV dueJan 22
Latest updateAug 28
CISA Required Action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:HExploitability: 2.3 | Impact: 6.0

Affected Packages4 packages

NVDivanti/policy_secure8 versions+7
NVDivanti/connect_secure8 versions+7
CVEListV5ivanti/ics9.1R189.1R18+1
CVEListV5ivanti/ips9.1R189.1R18+1

🔴Vulnerability Details

4
OSV
linux-realtime, linux-raspi-realtime vulnerabilities2025-08-28
GHSA
GHSA-87qj-c5f7-6c8q: A command injection vulnerability in web components of Ivanti Connect Secure (92024-01-12
CVEList
CVE-2024-21887: A command injection vulnerability in web components of Ivanti Connect Secure (92024-01-12
VulnCheck
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability2024

💥Exploits & PoCs

3
Metasploit
Ivanti Connect Secure Unauthenticated Remote Code Execution
Metasploit
Ivanti Connect Secure Unauthenticated Remote Code Execution
Nuclei
Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) - Command Injection

🔍Detection Rules

5
Suricata
ET EXPLOIT Ivanti Connect Secure (9.x,22.x) / Ivanti Policy Secure (9.x,22.x) / Ivanti Neurons for ZTA Command Injection via SSRF (CVE-2024-21887)2024-02-02
Suricata
ET WEB_SPECIFIC_APPS Possible Ivanti Pulse Secure Authentication Bypass and Command Injection Attempt M2 (CVE-2023-46805, CVE-2024-21887)2024-01-22
Suricata
ET WEB_SPECIFIC_APPS Possible Ivanti Pulse Secure Authentication Bypass and Command Injection Attempt (CVE-2023-46805, CVE-2024-21887) M12024-01-17
Suricata
ET WEB_SPECIFIC_APPS Ivanti Pulse Secure Authentication Bypass and Command Injection Attempt (CVE-2023-46805, CVE-2024-21887) M12024-01-16
Suricata
ET WEB_SPECIFIC_APPS Ivanti Pulse Secure Authentication Bypass and Command Injection Attempt (CVE-2023-46805, CVE-2024-21887) M22024-01-16

📋Vendor Advisories

2
Ivanti
Ivanti Connect Secure and Policy Secure Command Injection2024-01-10
CISA
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability2024-01-10

🕵️Threat Intelligence

14
Bleepingcomputer
CISA urges devs to weed out OS command injection vulnerabilities2024-07-10
Bleepingcomputer
Over 13,000 Ivanti gateways vulnerable to actively exploited bugs2024-02-15
Wiz
Critical Vulnerabilities in Ivanti Exploited In-The-Wild | Wiz Blog2024-02-06
Wiz
Critical Vulnerabilities in Ivanti Exploited In-The-Wild | Wiz Blog2024-02-06
Volexity
Ivanti Connect Secure VPN Exploitation: New Observations2024-01-18
CVE-2024-21887 — Ivanti Connect Secure | cvebase