{"uuid": "85f9fd3a-b2ef-443b-b091-2cad7418236f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "name": "February Security Advisory Ivanti Connect Secure (ICS),Ivanti Policy Secure (IPS) and Ivanti Secure Access Client (ISAC) (Multiple CVEs)", "description": "February Security Advisory Ivanti Connect Secure (ICS),Ivanti Policy Secure (IPS) and Ivanti Secure Access Client (ISAC) (Multiple CVEs)\n\nPrimary Product\n\nConnect-Secure\n\nCreated Date\n\nFeb 11, 2025 3:01:15 PM\n\nLast Modified Date\n\nFeb 11, 2025 3:37:50 PM\n\n**Summary**\n\nIvanti has released updates for Ivanti Connect Secure (ICS),Ivanti Policy Secure (IPS) and Ivanti Secure Access Client (ISAC) which addresses medium, high and critical severity vulnerabilities.\u00a0\n\nWe are not aware of any customers being exploited by these vulnerabilities at the time of disclosure.\n\n**Vulnerability Details**\n\n**CVE Number**\n\n**Description**\n\n**CVSS Score (Severity)**\n\n**CVSS Vector**\n\n**CWE**\n\n**Impacted Products**\n\nCVE-2024-38657\n\nExternal control of a file name in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to write arbitrary files.\n\n9.1 (Critical)\n\nCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\n\nCWE-73\n\nConnect Secure & Policy Secure\n\nCVE-2025-22467\n\nA stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to achieve remote code execution.\n\n9.9 (Critical)\n\nCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n\nCWE-121\n\nConnect Secure\n\nCVE-2024-10644\n\nCode injection in Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to achieve remote code execution.\n\n9.1 (Critical)\n\nCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H\n\nCWE-94\n\nConnect Secure & Policy Secure\n\nCVE-2024-12058\n\nExternal control of a file name in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote authenticated attacker with admin privileges to read arbitrary files.\n\n6.8 (Medium)\n\nCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\n\nCWE-73\n\nConnect Secure & Policy Secure\n\nCVE-2024-13830\n\nReflected XSS in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a remote unauthenticated attacker to obtain admin privileges. User interaction is required.\n\n6.1 (Medium)\n\nCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\n\nCWE-79\n\nConnect Secure & Policy Secure\n\nCVE-2024-13842\n\nA hardcoded key in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.3 allows a local unauthenticated attacker to read sensitive data.\n\n6.0 (Medium)\n\nCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\n\nCWE-321\n\nConnect Secure & Policy Secure\n\nCVE-2024-13843\n\nCleartext storage of information in Ivanti Connect Secure before version 22.7R2.6 and Ivanti Policy Secure before version 22.7R1.3 allows a local unauthenticated attacker to read sensitive data.\n\n6.0 (Medium)\n\nCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N\n\nCWE-312\n\nConnect Secure & Policy Secure\n\nCVE-2024-13813\n\nInsufficient permissions in Ivanti Secure Access Client before version 22.8R1 allows a local authenticated attacker to delete arbitrary files.\n\n7.1 (High)\n\nCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H\n\nCWE-732\n\nSecure Access Client\n\nAffected Versions\n\n**Product Name**\n\n**Affected Versions**\n\n**Resolved Versions**\n\n**Patch Availability**\n\nIvanti Connect Secure (ICS)\n\n22.7R2.5 and below\n\n22.7R2.6\n\nDownload Portal\n\n[https://portal.ivanti.com/](https://portal.ivanti.com/)\n\nIvanti Policy Secure (IPS)\n\n22.7R1.2 and below\n\n22.7R1.3\n\nDownload Portal\n\n[https://portal.ivanti.com/](https://portal.ivanti.com/)\n\nIvanti Secure Access Client (ISAC)\n\n22.7R4 and below\n\n22.8R1\n\nDownload Portal\n\n[https://portal.ivanti.com/](https://portal.ivanti.com/)\n\n**Solution**\n\nThese vulnerabilities are resolved on the latest version of the product and can be accessed in the download portal (Login Required):\n\n*   Ivanti Connect Secure 22.7R2.6\n*   Ivanti Policy Secure 22.7R1.3\n*   Ivanti Secure Access Client 22.8R1\n\n**Acknowledgements**\n\nIvanti would like to thank the following for reporting the relevant issues and for working with Ivanti to help protect our customers:\n\n*   Matthew Galligan, CISA Rapid Action Force (CVE-2024-38657)\n*   Ori David of Akamai (CVE-2024-37374, CVE-2024-37375)\n*   sim0nsecurity of HackerOne (CVE-2024-13813)\n\n_Note: Ivanti is dedicated to ensuring the security and integrity of our enterprise software products. We recognize the vital role that security researchers, ethical hackers, and the broader security community play in identifying and reporting vulnerabilities. Visit_ [_HERE_](https://www.ivanti.com/support/contact-security) _to learn more about our Vulnerability Disclosure Policy._\n\n**_FAQ_**\n\n1.  **Are you aware of any active exploitation of these vulnerabilities?**\n\nWe are not aware of any customers being exploited by these vulnerabilities prior to public disclosure. These vulnerabilities were disclosed through our responsible disclosure program.\u00a0\n\n2.  **How can I tell if I have been compromised?**  \n    Currently, there is no known public exploitation of this vulnerability that could be used to provide a list of indicators of compromise.\n3.  **What should I do if I need help?**\u00a0\n\nIf you have questions after reviewing this information, you can log a case and/or request a call via the [Success Portal](https://success.ivanti.com/Community_RegStep1_Page?inst=UL)\u00a0\n\n4.  **Are any of these vulnerability fixes backported to any of the 9.x versions?**\n\nNo. The Pulse Connect Secure 9.x version of the product reached End of Engineering June 2024 and has reached End-of-Support as of December 31, 2024. Because of this, the 9.x version of Connect Secure no longer receives backported fixes. We strongly encourage customers to upgrade to Ivanti Connect Secure 22.7 to benefit from important security updates that we have made throughout the solution.\u00a0\n\n5.  **What does it mean when a vulnerability describes remote authenticated attackers?**\n\nIt means that an attacker who is able to interact with the vulnerable component and pass authentication is able to exploit the vulnerability.\u00a0\u00a0\u00a0\u00a0\u00a0\n\nArticle Number :\n\n000097586\n", "creation_timestamp": "2025-02-11T19:05:13.397489+00:00", "timestamp": "2025-02-11T19:05:13.397489+00:00", "related_vulnerabilities": ["CVE-2024-12058", "CVE-2024-10644", "CVE-2024-13830", "CVE-2024-13843", "CVE-2024-38657", "CVE-2024-13813", "CVE-2024-37374", "CVE-2024-13842", "CVE-2025-22467", "CVE-2024-37375"], "author": {"login": "adulau", "name": "Alexandre Dulaunoy", "uuid": "c933734a-9be8-4142-889e-26e95c752803"}}