The US government's cybersecurity agency CISA is ramping up the pressure on organizations to urgently mitigate a pair of critical vulnerabilities in Ivanti Connect Secure VPN devices.
The CISA missive sets strict deadlines for Federal Civilian Executive Branch agencies running Ivanti Connect Secure and Ivanti Policy Secure to apply available mitigations, hunt for infections and share indicators of compromise.
The emergency directive also calls for the removal of compromised products from networks and a report to CISA that provides an inventory of infected devices and details on actions taken.
The CISA emergency directive comes less than two weeks after researchers at Volexity caught a Chinese government-backed hacking team chaining an exploit for the two Ivanti vulnerabilities to launch remote, unauthenticated code execution attacks.
In a research report released last week, Volexity flagged the two flaws as CVE-2023-46805 and CVE-2024-21887 and warned that they were being exploited against Internet-facing Ivanti Connect Secure VPN appliances.
Ivanti, a company that has struggled with major security problems, has released pre-patch mitigations for the new vulnerabilities but said comprehensive fixes will be released on a staggered schedule beginning on January 22.
The Volexity researchers said they caught the attackers modifying legitimate ICS components and making changes to the system to evade Ivanti's Integrity Checker Tool; and backdooring a legitimate CGI file on the ICS VPN appliance to allow command execution.
This Cyber News was published on www.securityweek.com. Publication date: Fri, 19 Jan 2024 22:13:04 +0000