Pierluigi Paganini October 02, 2024

U.S. Cybersecurity and Infrastructure Security Agency (CISA) adds Ivanti Endpoint Manager (EPM) vulnerability to its Known Exploited Vulnerabilities catalog.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the Ivanti Virtual Traffic Manager authentication bypass vulnerability CVE-2024-29824 (CVSS score of 9.6) to its Known Exploited Vulnerabilities (KEV) catalog.

In May, Ivanti rolled out security patches to address multiple critical vulnerabilities in the Endpoint Manager (EPM), including CVE-2024-29824.

The vulnerability CVE-2024-29824 is an unspecified SQL Injection issue in Core server of Ivanti EPM 2022 SU5 and prior. An unauthenticated attacker within the same network could exploit the vulnerability to execute arbitrary code.

At the time of its disclosure, the company reported that it was not aware of attacks in the wild exploiting the vulnerability.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.

Experts also recommend private organizations review the Catalog and address the vulnerabilities in their infrastructure.

CISA orders federal agencies to fix this vulnerability by October 23, 2024.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, CISA)