ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode
The Hacker Newspublished ()ingested @TheHackersNews

Ivanti Releases Urgent Security Updates for Endpoint Manager Vulnerabilities

criticalVulnerability exploited in the wildimportance 60CVE-2024-29847CVE-2024-32840CVE-2024-32842CVE-2024-32843CVE-2024-32845CVE-2024-32846CVE-2024-32848CVE-2024-34779CVE-2024-34783CVE-2024-34785CVE-2024-6342
Read the original
Tagscve-2024-29847cve-2024-32840cve-2024-32842cve-2024-32843cve-2024-32845vulnerability

Vulnerabilities mentionedAll →

CVEVulnerabilityCVSSEPSSFlagsAffectedExposurePublished
CVE-2024-29847
+9 in the same advisory: …32848 …34783 …32840 …34785 …32845 …34779 +3
Unauthenticated Deserialization RCE in Ivanti Endpoint Manager Agent Portal

CVE-2024-29847 is a deserialization of untrusted data flaw (CWE-502) in the agent portal of Ivanti Endpoint Manager (EPM). A remote, unauthenticated attacker can send maliciously crafted serialized data to the agent portal, and processing of that input results in remote code execution on the EPM server. Because EPM core servers typically hold privileged roles in enterprise Windows environments, successful exploitation could provide a foothold for broader network compromise. Organizations running EPM before the 2022 SU6 release, or before the 2024 September update, are affected. The flaw was patched in September 2024 with no public PoC or confirmed in-the-wild exploitation yet, but its high EPSS (52.9%, 99th percentile) suggests exploitation is likely within 30 days, and it arrives amid separate active exploitation of other Ivanti products (the Cloud Service Appliance), raising attacker interest in Ivanti software generally.

Do: Upgrade to Ivanti EPM 2022 SU6 if on the 2022 release line, or apply the September 2024 update if on the 2024 line. Restrict network access to the EPM agent portal to trusted management segments and review EPM servers for signs of compromise given the current attention on Ivanti products. Review Ivanti's September 2024 EPM advisory for additional vulnerabilities fixed at the same time.

9.8
group max
53%
  • Ivanti Endpoint Manager (EPM) - agent portal All versions before 2022 SU6
  • Ivanti Endpoint Manager (EPM) - agent portal All 2024-line versions before the September 2024 update
largetens of thousands of enterprise EPM deployments (internet-exposed footprint likely smaller)
CVE-2024-6342
**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542

**UNSUPPORTED WHEN ASSIGNED** A command injection vulnerability in the export-cgi program of Zyxel NAS326 firmware versions through V5.21(AAZF.18)C0 and NAS542 firmware versions through V5.21(ABAG.15)C0 could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request.

NVD description · AI analysis pending		9.82%
  • zyxel nas326 firmware
  • zyxel nas542 firmware
—
Full article366 words · extracted from thehackernews.com · click to collapse

Ravie LakshmananSep 11, 2024Enterprise Security / Vulnerability

Ivanti has released software updates to address multiple security flaws impacting Endpoint Manager (EPM), including 10 critical vulnerabilities that could result in remote code execution.

A brief description of the issues is as follows -

  • CVE-2024-29847 (CVSS score: 10.0) - A deserialization of untrusted data vulnerability that allows a remote unauthenticated attacker to achieve code execution.
  • CVE-2024-32840, CVE-2024-32842, CVE-2024-32843, CVE-2024-32845, CVE-2024-32846, CVE-2024-32848, CVE-2024-34779, CVE-2024-34783, and CVE-2024-34785 (CVSS scores: 9.1) - Multiple unspecified SQL injection vulnerabilities that allow a remote authenticated attacker with admin privileges to achieve code execution

The flaws impact EPM versions 2024 and 2022 SU5 and earlier, with fixes made available in versions 2024 SU1 and 2022 SU6, respectively.

Ivanti said it has found no evidence of the flaws being exploited in the wild as a zero-day, but it's essential that users update to the latest version to safeguard against potential threats.

Also addressed as part of the September update are seven high-severity shortcomings in Ivanti Workspace Control (IWC) and Ivanti Cloud Service Appliance (CSA).

The company said it has ramped up its internal scanning, manual exploitation and testing capabilities, and that it made improvements to its responsible disclosure process to swiftly discover and address potential issues.

"This has caused a spike in discovery and disclosure," the company noted.

The development comes in the aftermath of extensive in-the-wild exploitation of several zero-days in Ivanti appliances, including by China-nexus cyber espionage groups to breach networks of interest.

It also comes as Zyxel shipped fixes for a critical operating system (OS) command injection vulnerability (CVE-2024-6342, CVSS score: 9.8) in two of its network-attached storage (NAS) devices.

"A command injection vulnerability in the export-cgi program of Zyxel NAS326 and NAS542 devices could allow an unauthenticated attacker to execute some operating system (OS) commands by sending a crafted HTTP POST request," the company said in an alert.

The security hole has been addressed in the below versions -

  • NAS326 (affects V5.21(AAZF.18)C0 and earlier) - Fixed in V5.21(AAZF.18)Hotfix-01
  • NAS542 (affects V5.21(ABAG.15)C0 and earlier) - Fixed in V5.21(ABAG.15)Hotfix-01

Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.

Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/09/ivanti-releases-urgent-security-updates.html