CVE CVE

CVE-2024-7593

CISA Known Exploited Vulnerability (KEV)

Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

September 24, 2024

October 15, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Description

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

Weakness Enumeration

CWE-ID CWE Name

CWE-287
Improper Authentication

Details

Source:
NVD
Published:
Updated:

Risk information

CVSS v3

Base score:
9.8
Severity:

CRITICAL

Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CVSS v2

Not defined