CVE-2024-21887 is a critical command injection vulnerability affecting Ivanti Connect Secure and Ivanti Policy Secure software. This vulnerability allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the affected systems. The severity of this vulnerability is high, with a CVSS 3.x base score of 9.1. It is important for organizations using these software versions to address this vulnerability to maintain the security of their systems.

How do I know if I'm affected?

If you're wondering whether you're affected by the CVE-2024-21887 vulnerability, you'll need to check if you're using Ivanti Connect Secure or Ivanti Policy Secure software. The affected versions are 9.x and 22.x. If you're using one of these versions, it's crucial to address this vulnerability to maintain the security of your systems.

What should I do if I'm affected?

If you're affected by this vulnerability, it's crucial to take immediate action. First, apply the patch available via Ivanti's standard download portal for Connect Secure and Policy Secure versions. Next, follow the provided Knowledge Base article for detailed instructions on applying the mitigation. If you need further support, log a case or request a call in the Success Portal. Remember to stay updated on the latest known exploited vulnerabilities and follow vendor instructions for mitigation.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2024-21887 vulnerability is indeed listed in CISA's Known Exploited Vulnerabilities Catalog. This vulnerability, named Ivanti Connect Secure and Policy Secure Command Injection Vulnerability, was added to the catalog on January 10, 2024, with a due date of January 22, 2024. To address this vulnerability, organizations must apply mitigations as per vendor instructions or discontinue the use of the affected product if mitigations are unavailable.

Weakness enumeration

The weakness enumeration for this vulnerability is categorized as CWE-77. This is a command injection issue that allows an authenticated administrator to execute arbitrary commands on affected systems. It impacts Ivanti Connect Secure and Ivanti Policy Secure software versions 9.x and 22.x.

For more details

CVE-2024-21887 is a critical vulnerability that requires immediate attention. For a comprehensive understanding of its description, severity, technical details, and affected software configurations, refer to the NVD page.

• Packet Storm

• Ivanti

• Cybersecurity & Infrastructure Security Agency (CISA)

• CISA Known Exploited Vulnerabilities Catalog