CISA urged enterprises to address two Ivanti zero-day vulnerabilities that remain unpatched amid reports of active exploitation by a Chinese nation-state threat actor.
Ivanti published a security advisory Wednesday for an authentication bypass vulnerability tracked as CVE-2023-46805 that affects Ivanti Policy Secure and a command injection flaw assigned CVE-2024-21887 in Ivanti Connect Secure versions 9.x and 22.x. The zero-day vulnerabilities warranted a simultaneous alert from CISA warning users and administrators to apply workarounds while Ivanti develops patches.
CISA also added the flaws to its Known Exploited Vulnerabilities catalog, which requires federal agencies to promptly remediate.
While CISA said Ivanti received reports of exploitation, Ivanti's security advisory did not address that threat.
A separate blog post published by Volexity Wednesday revealed that the zero-day vulnerabilities were exploited by a nation-state actor.
The cybersecurity vendor initially detected suspicious activity during the second week of December.
Prior to reporting the flaws to Ivanti, Volexity discovered that UTA0178 chained the zero-day vulnerabilities to achieve unauthenticated remote code execution on vulnerable systems.
During the attack, Volexity observed the threat actor stealing configuration data, modifying existing files, downloading remote files and reverse tunneling from the ICS VPN appliance.
Only a limited number of customers have been compromised, but patches are not yet available.
CVE-2023-46805 received a CVSS score of 8.2, and CVE-2024-21887 ranked higher with a 9.1 CVSS score.
The latter was discovered in ICS, which features a remote access VPN - a growing attack vector amid a rise in hybrid work.
Ivanti's security advisory also warned that if the vulnerabilities are chained, unauthorized attackers could execute arbitrary commands on the system.
It addressed how the flaws could affect gateways used for control in its zero-trust access offering, Ivanti Neurons for ZTA. The good news is that the advisory emphasized ZTA gateways cannot be exploited when in production, but risks remain.
A final version will be released beginning Feb. 19.
Satnam Narang, senior staff research engineer at Tenable, said he is most concerned with the lack of patches and the anticipated wait time of several weeks.
He also addressed the recent targeting of other Ivanti products.
Over the summer, Ivanti patched three critical zero-day vulnerabilities that were under active exploitation just one month apart, signaling that attackers will likely take notice.
Arielle Waldman is a Boston-based reporter covering enterprise security news.
This Cyber News was published on www.techtarget.com. Publication date: Thu, 11 Jan 2024 20:13:05 +0000