CVE-2024-22052

—

CVSS 3.1

7.5 high

EPSS

4%p89

Published

Apr 4, 2024 (Apr 4, 2024)

Modified

Jun 17, 2026

Description

A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack

Vendors: ivanti
Products: connect secure, policy secure
Weakness: CWE-476, CWE-703
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

NVD CVE.org GitHub PoCs EPSS (3.8%)

In the news3 stories

Ivanti vows to transform its security operating model, reveals new vulnerabilities

Help Net SecurityApr 18, 11:48 UTC · Apr 18, 2024Vulnerability CVE-2024-21894 CVE-2024-22053 CVE-2024-22052+1 CVEs

Ivanti fixed for 4 new issues in Connect Secure and Policy Secure

Security AffairsApr 4, 08:10 UTC · Apr 4, 2024Exploit / PoC CVE-2024-21894 CVE-2024-22052 CVE-2024-22053+5 CVEs

Ivanti Rushes Patches for 4 New Flaws in Connect Secure and Policy Secure

The Hacker NewsApr 4, 06:30 UTC · Apr 4, 2024Vulnerability CVE-2024-21894 CVE-2024-22052 CVE-2024-22053+3 CVEs