"Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability"

Security Researchers at the Shadowserver Foundation have identified thousands of internet-exposed Ivanti VPN appliances likely impacted by a recently disclosed vulnerability leading to remote code execution.  The researchers described the vulnerability, tracked as CVE-2024-21894 (CVSS 8.2), as a heap overflow bug in the IPSec component of Ivanti Connect Secure (formerly Pulse Connect Secure) and Policy Secure that could be exploited by remote, unauthenticated attackers to cause a denial-of-service (DoS) condition or execute arbitrary code.  The researchers say that on April 2, Ivanti released software updates to address this flaw and three other vulnerabilities in its two VPN appliances, including CVE-2024-22053, another high-severity heap overflow bug leading to DoS.  The issue impacts all supported versions of Connect Secure and Policy Secure, and Ivanti has urged all users to update their instances, albeit noting that it was not aware of these bugs being exploited at the time of disclosure. On Friday, the researchers identified over 16,000 Ivanti VPN instances potentially impacted by CVE-2024-21894.  As of April 7, ShadowServer data shows roughly 10,000 internet-accessible Ivanti Connect Secure and Policy Secure instances vulnerable to CVE-2024-21894.  Most of the appliances are in the US (3,700) and Japan (1,700), followed by the UK (860), France (710), Germany (570), China (440), Canada (300), and India (290).  The researchers noted that it is unclear how many of these are actual Ivanti VPNs or honeypots and whether the decrease in observed instances was caused by patching.

SecurityWeek reports: "Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability"