Description
Authentication bypass by spoofing in ICS before version 25.1.3.0 allows a remote unauthenticated attacker to execute arbitrary commands. This does not impact ICS version 22.7R2.14 or prior.
CVSS breakdown
CVSS 3.1
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
Low
Affected products
- Ivanti / Connect Secure25.1.3.0 – 25.1.3.0
- Ivanti / Connect Secure25.1.3.1 – 25.1.3.1
- Ivanti / Connect Secure22.8R2.5 – 22.8R2.5
- Ivanti / Connect Secure22.7R2.14 – 22.7R2.14
- Ivanti / Connect Secure25.1.0.0 – 25.1.1.2
- Ivanti / Connect Secure22.8 – 22.8
- Ivanti / Connect Secure22.8 – 22.8
- Ivanti / Connect Secure22.8 – 22.8
- Ivanti / Connect Secure22.8 – 22.8
- Ivanti / Connect Secure22.8 – 22.8
Exploits & proofs of concept
- nucleiIvanti Connect Secure <= 22.8R2.4 - Authentication Bypass via X-DSCGI-PATH Headerby volexity,DhiyaneshDk
News coverage
- Ivanti ICS Zero-Day Attacks Highlight Vendor Patching HurdlesDark Reading · 12d ago
- CISA Urges Immediate Ivanti Connect Secure Updates as Honeypots Log 105 Exploit AttemptsThe Hacker News · 13d ago
Updated 22m ago · 8 sources