# MA-1011.012024: MyCERT Advisory - Exploited two zero-day vulnerabilities in Ivanti Connect Secure VPN

**Date:** 14 Jan 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1011.012024  
**Advisory ID:** MA-1011.012024

---

**1.0 Introduction**
Recently, Ivanti has released a [security update](https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US) to address an authentication bypass vulnerability ([CVE-2023-46805](https://www.cve.org/CVERecord?id=CVE-2023-46805)) and a command injection vulnerability ([CVE-2024-21887](https://www.cve.org/CVERecord?id=CVE-2024-21887)) in all supported versions (9.x and 22.x) of Connect Secure and Policy Secure gateways.
**2.0 Impact**
A cyber threat actor could exploit these vulnerabilities to take control of an affected system. Ivanti reports active exploitation of both CVE-2023-46805 and CVE-2024-21887.
**3.0 Affected Products**
Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure and Ivanti Policy Secure gateways. These vulnerabilities impact all supported versions – Version 9.x and 22.x (refer to [Granular Software Release EOL Timelines and Support Matrix](https://forums.ivanti.com/s/article/Granular-Software-Release-EOL-Timelines-and-Support-Matrix?language=en_US) for supported versions).
**4.0 Recommendations**
MyCERT urges users and administrators to immediately apply the current workaround in [Ivanti's security update](https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US) and review [Ivanti's KB article](https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US), [Volexity's blog](https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/) and [Mandiant's blog](https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day) on these vulnerabilities.
Kindly refer to the following URLs:
- <https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US>
- <https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US>
- <https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/>
- <https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day>
Generally, MyCERT advises the users of this devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US>
- <https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US>
- <https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/>
- <https://www.mandiant.com/resources/blog/suspected-apt-targets-ivanti-zero-day>
- <https://www.cisa.gov/news-events/alerts/2024/01/10/ivanti-releases-security-update-connect-secure-and-policy-secure-gateways>