Unrated severityNVD Advisory· Published Apr 4, 2024· Updated Oct 3, 2024

CVE-2024-21894

Description

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack. In certain conditions this may lead to execution of arbitrary code

Affected products

Ivanti/Connect Securellm-fuzzy2 versions
9.x, 22.x+ 1 more
- (no CPE)range: 9.x, 22.x
- (no CPE)range: 22.1R6.2
Ivanti/Policy Securellm-fuzzy2 versions
(expand)+ 1 more
- (no CPE)
- (no CPE)range: 22.4R1.2

Patches

Vulnerability mechanics

References

forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gatewaysmitre

News mentions

No linked articles in our index yet.

cvss	0.000
epss	0.015
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000