CVE-2024-11005 - Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution

Back Back to CVE browser

CRITICAL

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution

Published Nov 12, 2024

9.1

CRITICAL

CVSS 3.1

EPSS 1.64%

Description

Command injection in Ivanti Connect Secure before version 22.7R2.1 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.1 (Not Applicable to 9.1Rx) allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Affected products

Vendor Ivanti Product Connect Secure Default
unaffected
- Version
  22.7R2.1
  Status
  affected
  Constraints
  -
Vendor Ivanti Product Policy Secure Default
unaffected
- Version
  22.7R1.1
  Status
  affected
  Constraints
  -

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Ivanti

Connect Secure

unaffected

Version	Status	Constraints
22.7R2.1	affected	-

Ivanti

Policy Secure

unaffected

Version	Status	Constraints
22.7R1.1	affected	-

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-78

OS Command Injection

References (2)

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-33605		Advisory
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs		Vendor Advisory