The U.S. Cybersecurity and Infrastructure Security Agency (CISA)\u00a0added<\/a> Ivanti Cloud Services Appliance OS Command Injection Vulnerability CVE-2024-8190<\/a> (CVSS score of 7.2) to its Known Exploited Vulnerabilities (KEV) catalog<\/a>.<\/p>\n\n\n\n
\u201cFollowing public disclosure, Ivanti has confirmed exploitation of this vulnerability in the wild. At the time of this update, we are aware of a limited number of customers who have been exploited.\u201d reads the update<\/a> provided by the company on September 13, 2024.<\/em><\/p>\n\n\n\n
\u201cAn OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.\u201d reads the advisory<\/a>. <\/em><\/p>\n\n\n\n
Ivanti released a security update for Ivanti CSA 4.6 to address the vulnerability.<\/p>\n\n\n\n
The company note that CSA 4.6 is End-of-Life<\/a>, and no longer receives updates for OS or third-party libraries. Customers must upgrade to Ivanti CSA 5.0 for continued support, this version is not impacted by this vulnerability. <\/p>\n\n\n\n
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities<\/a>, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts also recommend private organizations review the Catalog<\/a> and address the vulnerabilities in their infrastructure.<\/p>\n\n\n\n
CISA orders federal agencies to fix this vulnerability by\u00a0October 4, 2024.<\/p>\n\n\n\n
Follow me on Twitter: @securityaffairs<\/strong><\/a> and Facebook<\/strong><\/a> and Mastodon<\/strong><\/a><\/p>\n\n\n\n
Pierluigi Paganini<\/strong><\/a><\/p>\n\n\n\n
(<\/strong>SecurityAffairs<\/strong><\/a>\u00a0\u2013<\/strong>\u00a0hacking, CISA)<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"