CVE-2024-10644
Published: 11 February 2025
Description
Code injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
Security Summary
CVE-2024-10644 is a code injection vulnerability (CWE-94) affecting Ivanti Connect Secure prior to version 22.7R2.4 and Ivanti Policy Secure prior to version 22.7R1.3. Published on February 11, 2025, it carries a CVSS v3.1 base score of 9.1 (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), indicating critical severity due to its potential for high-impact remote code execution.
The vulnerability can be exploited by a remote authenticated attacker possessing administrative privileges. Successful exploitation enables remote code execution on the targeted system, with changed scope allowing potential compromise beyond the vulnerable component.
Ivanti's February Security Advisory, available at https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs, addresses this CVE alongside others. Mitigation requires upgrading to Ivanti Connect Secure version 22.7R2.4 or later and Ivanti Policy Secure version 22.7R1.3 or later.
Details
- CWE(s)