cbcvebase.
CVE-2024-22053
published 2024-04-04

CVE-2024-22053: A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send…

PriorityP350high8.2CVSS 3.1
AVNACLPRNUINSUCLINAH
EPSS
3.53%
87.8th percentile
A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory.

Affected

36 ranges· showing 25
VendorProductVersion rangeFixed in
ivanticonnect_secure——
ivanticonnect_secure——
ivanticonnect_secure——
ivanticonnect_secure——
ivanticonnect_secure——
ivanticonnect_secure——
ivanticonnect_secure——
ivanticonnect_secure——
ivanticonnect_secure>= 22.1R6.2 < 22.1R6.222.1R6.2
ivanticonnect_secure>= 22.2R4.2 < 22.2R4.222.2R4.2
ivanticonnect_secure>= 22.3R1.2 < 22.3R1.222.3R1.2
ivanticonnect_secure>= 22.4R1.2 < 22.4R1.222.4R1.2
ivanticonnect_secure>= 22.4R2.4 < 22.4R2.422.4R2.4
ivanticonnect_secure>= 22.5R1.3 < 22.5R1.322.5R1.3
ivanticonnect_secure>= 22.5R2.4 < 22.5R2.422.5R2.4
ivanticonnect_secure>= 22.6R2.3 < 22.6R2.322.6R2.3
ivanticonnect_secure>= 9.1R14.6 < 9.1R14.69.1R14.6
ivanticonnect_secure>= 9.1R15.4 < 9.1R15.49.1R15.4
ivanticonnect_secure>= 9.1R16.4 < 9.1R16.49.1R16.4
ivanticonnect_secure>= 9.1R17.4 < 9.1R17.49.1R17.4
ivanticonnect_secure>= 9.1R18.5 < 9.1R18.59.1R18.5
ivantipolicy_secure——
ivantipolicy_secure——
ivantipolicy_secure——
ivantipolicy_secure——

CVSS provenance

nvdv3.18.2HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
nvdv3.08.2HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.