CyberWatch

Critical Ivanti Virtual Traffic Manager Vulnerability Added to CISA KEV Catalog

By

Matthew Fagan, Vulnerability Management Patch Analyst

By

Access Point Consulting

Summary

On August 12, Ivanti issued an advisory regarding a critical vulnerability in the Ivanti Virtual Traffic Manager (vTM), identified as CVE-2024-7593 with a CVSS score of 9.8. The vulnerability stems from an incorrect implementation of an authentication algorithm. Patches were released on August 19th for all affected versions. On September 24th, the vulnerability was added to the CISA Known Exploited Vulnerabilities Catalog (KEV), elevating its priority and risk.

Impact

This vulnerability, now listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog, carries a critical severity level, significantly increasing its risk profile. Exploiting this vulnerability can lead to a complete loss of system Confidentiality, Integrity, and Availability. It has been associated with two Common Weakness Enumerations (CWEs): CWE-287 (Improper Authentication) and CWE-303 (Incorrect Implementation of Authentication Algorithm). Essentially, this flaw allows attackers to bypass critical authentication measures in the Ivanti Virtual Traffic Manager, putting systems at serious risk.

The affected versions of Ivanti Virtual Traffic Manager are: 22.2, 22.3, 22.3R2, 22.5R1, 22.6R1, and 22.7R1. The remediated versions are: 22.2R1, 22.3R3, 22.5R2, 22.6R2, and 22.7R2.

It is crucial to update to one of the remediated versions listed above. Ivanti provides detailed documentation to assist in upgrading the Virtual Traffic Manager.

Mitigation

To reduce the risk of exploitation, Ivanti recommends restricting Admin Access to the Management Interface, as outlined in their advisory.

Recommendations

  • Apply Updates: Updates are available for all affected versions of vTM. These should be applied immediately, as CISA has confirmed evidence of active exploitation.
  • Implement Mitigation Measures: Ivanti has provided additional mitigations to reduce the attack surface. Ensure the management interface is bound to an internal network or private IP address. Detailed network configuration guidance is provided in Ivanti's advisory, including steps in the "Mitigation or Workaround" section.
  • Check for Indicators of Compromise: Ivanti has provided indicators to detect potential exploitation. Review Audit Logs for signs of unauthorized user creation, particularly new users being added to an administrator group. This could be a sign that an attacker has breached the system and is attempting to escalate privileges.

Associated Bulletins

Security Advisory: Ivanti Virtual Traffic Manager (vTM ) (CVE-2024-7593)

NVD - CVE-2024-7593 (nist.gov)

Resources

Trending Articles & Security Reports

Resources

CyberWatch

October 7, 2024

VINs and Losses: How Hackers Take Kias for a Ride

In the age of smart cars and connected devices, convenience often comes with hidden risks. A recently discovered critical vulnerability in Kia vehicles serves as a stark reminder of how our increasingly digital world is making cars new targets for cyberattacks. This vulnerability allowed hackers to remotely control various vehicle functions—using nothing more than a car's license plate number. It highlights the growing threat of cyberattacks on connected cars and the importance of cybersecurity in the automotive industry.

Find out more
October 3, 2024

Vulnerability in SolarWinds Managed File Transfer Server Actively Exploited

CVE-2024-28995 SolarWinds has issued a critical update for a zero-day vulnerability in its Serv-U MFT Server, allowing attackers to bypass security and access restricted files without authentication. Actively exploited, this flaw poses a significant risk for businesses that delay applying the fix.

Find out more
October 1, 2024

Critical Container Flaw Could Impact NVIDIA AI Services

On September 25th, NVIDIA issued a security advisory regarding a critical vulnerability (CVE-2024-0132) in the NVIDIA Container Toolkit. This Time-of-Check Time-of-Use (TOCTOU) flaw allows a specially crafted container image to access the host file system. The vulnerability impacts most AI applications in both cloud and on-prem environments using NVIDIA GPUs.

Find out more