CVE-2024-38657

—1

CVSS 3.1

4.9 medium

EPSS

2%p74

Published

Feb 21, 2025 (Feb 21, 2025)

Modified

Jun 17, 2026

Description

External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files.

Vendors: ivanti
Products: connect secure, policy secure
Weakness: CWE-73
Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.6%)

In the news3 stories

⚡ THN Weekly Recap: Google Secrets Stolen, Windows Hack, New Crypto Scams and More

The Hacker NewsJun 10, 09:34 UTC · Jun 10, 2025Phishing & fraud CVE-2025-1094 CVE-2025-0108 CVE-2025-23359+31 CVEs

Critical Ivanti Flaw Actively Exploited to Deploy TRAILBLAZE and BRUSHFIRE Malware

The Hacker NewsApr 7, 06:39 UTC · Apr 7, 2025Malware in the wildCVE-2025-22457 CVE-2024-38657 CVE-2025-22467+2 CVEs

Ivanti Patches Critical Flaws in Connect Secure and Policy Secure

The Hacker NewsFeb 18, 12:12 UTC · Feb 18, 2025Vulnerability in the wildCVE-2024-38657 CVE-2025-22467 CVE-2024-10644+7 CVEs