Exploit / PoCcritical

Researchers Identify Multiple China Hacker Groups Exploiting Ivanti Security Flaws

The Hacker Newsby @TheHackersNewsApr 6, 2024 · 09:12 UTC (Apr 6, 2024)3 min read2 · 1 read

Read at thehackernews.com

Analyze CVE-2023-46805 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2023-46805 CVE-2024-21887 CVE-2024-21893

Tags: cve-2023-46805 cve-2024-21887 cve-2024-21893 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2024-21887 +1 related CVE CVE-2023-46805	Command Injection RCE in Ivanti Connect Secure and Policy Secure	9.1 group max	100%	KEVRansomwarePoC	Jan 12, 2024 KEV Jan 10, 2024
CVE-2024-21893	SSRF in Ivanti Connect Secure, Policy Secure, and Neurons SAML Component	8.2	100%	KEVRansomware	Jan 31, 2024 KEV Jan 31, 2024

From the original article

3 min read at thehackernews.com

Multiple China-nexus threat actors have been linked to the zero-day exploitation of three security flaws impacting Ivanti appliances (CVE-2023-46805, CVE-2024-21887, and CVE-2024-21893). The clusters are being tracked by Mandiant under the uncategorized monikers UNC5221 , UNC5266, UNC5291, UNC5325 , UNC5330, and UNC5337.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.