Ivanti Patches Critical Flaws in Connect Secure and Policy Secure
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2025-22467+1 related CVE | A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution | 8.8 group max | 5% | ||
| CVE-2024-38657 | External control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated… | 4.9 | 2% | ||
CVE-2024-46668+1 related CVE | An allocation of resources without limits or throttling vulnerability [CWE-770] in FortiOS versions 7.4.0 through 7.4.4, versions 7.2.0 through 7.2.8, versions… | 7.5 group max | <1% | ||
| CVE-2024-47908 | OS Command Injection in Ivanti Cloud Services Appliance Admin Console Enables Admin RCE | 7.2 | 22% | ||
| CVE-2024-53704 | Authentication Bypass in SonicWall SonicOS SSLVPN | 9.8 | 95% | KEVRansomware | KEV |
| CVE-2024-55591 | Unauthenticated Super-Admin Bypass in Fortinet FortiOS and FortiProxy | 9.8 | 94% | KEVRansomware | KEV |
| CVE-2025-0282 | Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 9.0 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-24472 | Authentication Bypass in Fortinet FortiOS and FortiProxy Grants Super-Admin Access | 8.1 | 7% | KEVRansomware | KEV |
From the original article
4 min read at thehackernews.com
Ravie Lakshmanan Feb 12, 2025 Network Security / Vulnerability Ivanti has released security updates to address multiple security flaws impacting Connect Secure (ICS), Policy Secure (IPS), and Cloud Services Application (CSA) that could be exploited to achieve arbitrary code execution. CVE-2024-38657 (CVSS score: 9. 1) - External control of a file name in Ivanti Connect Secure before version 22.
By @TheHackersNews · thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.