diff --git a/docs/advisories/20240904001-Ivanti-Critical-Vulnerability-PoC-Published.md b/docs/advisories/20240904001-Ivanti-Critical-Vulnerability-PoC-Published.md new file mode 100644 index 00000000..cc587152 --- /dev/null +++ b/docs/advisories/20240904001-Ivanti-Critical-Vulnerability-PoC-Published.md @@ -0,0 +1,22 @@ +# Ivanti Critical Vulnerability PoC Published - 20240904001 + +## Overview + +Ivanti released updates for Ivanti Virtual Traffic Manager (vTM) which addressed a critical vulnerability. Successful exploitation could lead to authentication bypass and creation of an administrator user. + +## What is vulnerable? + +| Product(s) Affected | Version(s) | CVE # | CVSS v4/v3 | Severity | +| ------------------------------ | ------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------- | ---------- | -------- | +| Ivanti Virtual Traffic Manager | 22.2 \< 22.2R1
22.3 \< 22.3R3
22.3R2 \< 22.3R3
22.5R1 \< 22.5R2
22.6R1 \< 22.6R2
22.7R1 \< 22.7R2 | [CVE-2024-7593](https://nvd.nist.gov/vuln/detail/CVE-2024-7593) | 9.8 | Critical | + +## What has been observed? + +Ivanti is not aware of any customers being exploited by this vulnerability at the time of disclosure, however a Proof of Concept is publicly available. +There is no evidence of exploitation affecting Western Australian Government networks at the time of publishing. + +## Recommendation + +The WA SOC recommends administrators apply the solutions as per vendor instructions to all affected devices within expected timeframe of *48 hours...* (refer [Patch Management](../guidelines/patch-management.md)): + +- Vendor article: