News
Vulnerability · Global · January 2024
Ivanti Connect Secure Chained Vulnerabilities
An authentication bypass chained with command injection enabled unauthenticated compromise of Ivanti VPN appliances.
Incident
What happened
CVE-2023-46805 (authentication bypass) and CVE-2024-21887 (command injection) could be chained for remote code execution.
Exploitation was observed before patches were available, and CISA issued an emergency directive to US federal agencies.
Attackers attempted to evade the vendor's integrity checking tool.
Analysis
Lessons learned
VPN appliances need layered monitoring, not only vendor integrity checks.
Incident readiness should include procedures for appliances that cannot be patched immediately.
Segmentation reduces what an attacker can reach after compromising an edge device.
Prevention
How penetration testing helps
Network testing verifies segmentation and what an attacker can reach from a compromised perimeter device.
Sources
Summary based on publicly available information. DIGITPOL HK was not involved in this incident.