Ivanti has disclosed two Connect Secure and Policy Secure zero-days exploited in the wild that can let remote attackers execute arbitrary commands on targeted gateways.
The first security flaw is an authentication bypass in the gateways' web component, enabling attackers to access restricted resources by circumventing control checks.
The second is a command injection vulnerability that lets authenticated admins execute arbitrary commands on vulnerable appliances by sending specially crafted requests.
When chaining the two zero-days, reported by Mandiant and Volexity, attackers can run arbitrary commands on all supported versions of the impacted products.
Until patches are available, the zero-days can be mitigated by importing mitigation.
1.xml file available to customers via Ivanti's download portal.
Ivanti says the two zero-days have already been exploited in the wild in attacks targeting a small number of customers.
As reported by Shodan, according to a search string shared by security expert Kevin Beaumont, over 15,000 Connect Secure and Policy Secure gateways are currently exposed online.
Beaumont also warned earlier today that the two zero-days are used in attacks and allow MFA bypass and code execution.
Last week, Ivanti said that a critical remote code execution vulnerability in its Endpoint Management software could be abused by unauthenticated attackers to hijack enrolled devices or the core server.
In July, state hackers explored two other zero-days in Ivanti's Endpoint Manager Mobile to breach the networks of several Norwegian government organizations.
A month later, hackers exploited a third zero-day flaw in Ivanti's Sentry software to bypass API authentication on vulnerable devices.
Ivanti's products are used by over 40,000 companies worldwide to manage their IT assets and systems.
The biggest cybersecurity and cyberattack stories of 2023.
Malware abuses Google OAuth endpoint to 'revive' cookies, hijack accounts.
Ivanti warns critical EPM bug lets hackers hijack enrolled devices.
Apache OFBiz RCE flaw exploited to find vulnerable Confluence servers.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 10 Jan 2024 18:55:28 +0000