Pierluigi Paganini
September 14, 2024
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) Ivanti Cloud Services Appliance OS Command Injection Vulnerability CVE-2024-8190 (CVSS score of 7.2) to its .
This week, Ivanti warned that recently patched flaw CVE-2024-8190 in Cloud Service Appliance (CSA) is being actively exploited in the wild.
“Following public disclosure, Ivanti has confirmed exploitation of this vulnerability in the wild. At the time of this update, we are aware of a limited number of customers who have been exploited.” reads the provided by the company on September 13, 2024.
An attacker can trigger this high-severity vulnerability to achieve remote code execution under specific conditions.
“An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.” reads the .
“Successful exploitation could lead to unauthorized access to the device running the CSA. Dual-homed CSA configurations with ETH-0 as an internal network, as recommended by Ivanti, are at a significantly reduced risk of exploitation.”
Ivanti released a security update for Ivanti CSA 4.6 to address the vulnerability.
The company note that , and no longer receives updates for OS or third-party libraries. Customers must upgrade to Ivanti CSA 5.0 for continued support, this version is not impacted by this vulnerability.
The company did not reveal details about the attacks exploiting the CVE-2024-8190 vulnerability.
According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by October 4, 2024.
Follow me on Twitter: and and Mastodon
(SecurityAffairs – hacking, CISA)
