Summary
On August 12, Ivanti issued an advisory regarding a critical vulnerability in the Ivanti Virtual Traffic Manager (vTM), identified as CVE-2024-7593 with a CVSS score of 9.8. The vulnerability stems from an incorrect implementation of an authentication algorithm. Patches were released on August 19th for all affected versions. On September 24th, the vulnerability was added to the CISA Known Exploited Vulnerabilities Catalog (KEV), elevating its priority and risk.
Impact
This vulnerability, now listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, carries a critical severity level, significantly increasing its risk profile. Exploiting this vulnerability can lead to a complete loss of system Confidentiality, Integrity, and Availability. It has been associated with two Common Weakness Enumerations (CWEs): CWE-287 (Improper Authentication) and CWE-303 (Incorrect Implementation of Authentication Algorithm). Essentially, this flaw allows attackers to bypass critical authentication measures in the Ivanti Virtual Traffic Manager, putting systems at serious risk.
The affected versions of Ivanti Virtual Traffic Manager are: 22.2, 22.3, 22.3R2, 22.5R1, 22.6R1, and 22.7R1. The remediated versions are: 22.2R1, 22.3R3, 22.5R2, 22.6R2, and 22.7R2.
It is crucial to update to one of the remediated versions listed above. Ivanti provides detailed documentation to assist in upgrading the Virtual Traffic Manager.
Mitigation
To reduce the risk of exploitation, Ivanti recommends restricting Admin Access to the Management Interface, as outlined in their advisory.
Recommendations
- Apply Updates: Updates are available for all affected versions of vTM. These should be applied immediately, as CISA has confirmed evidence of active exploitation.
- Implement Mitigation Measures: Ivanti has provided additional mitigations to reduce the attack surface. Ensure the management interface is bound to an internal network or private IP address. Detailed network configuration guidance is provided in Ivanti's advisory, including steps in the "Mitigation or Workaround" section.
- Check for Indicators of Compromise: Ivanti has provided indicators to detect potential exploitation. Review Audit Logs for signs of unauthorized user creation, particularly new users being added to an administrator group. This could be a sign that an attacker has breached the system and is attempting to escalate privileges.
Associated Bulletins
Security Advisory: Ivanti Virtual Traffic Manager (vTM ) (CVE-2024-7593)
NVD - CVE-2024-7593 (nist.gov)
.png)
.webp)
.png)
