CVE-2024-37404 is an Improper Input Validation vulnerability affecting the admin portal of Ivanti Connect Secure (versions prior to 22.7R2.1 and 9.1R18.9) and Ivanti Policy Secure (versions prior to 22.7R1.1). This high-severity vulnerability, with a CVSS score of 8.8, allows a remote authenticated attacker to achieve remote code execution (RCE) with low attack complexity and no user interaction required. While not yet in CISA's KEV catalog, a Metasploit module for exploitation exists, and it has garnered significant community discussion, indicating a high potential for active exploitation.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* | ||
>= 22.3, < 22.7CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:r10:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:r10.2:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.3 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.