# MA-1024.012024: MyCERT Advisory - CISA Issues Emergency Directive on Ivanti Vulnerabilities

**Date:** 30 Jan 2024  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1024.012024  
**Advisory ID:** MA-1024.012024

---

**1.0 Introduction**
Recently, CISA has issued [Emergency Directive (ED) 24-01 Mitigate Ivanti Connect Secure and Ivanti Policy Secure Vulnerabilities](https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities) (<https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities>) in response to active vulnerabilities in the following Ivanti products: Ivanti Connect Secure and Ivanti Policy Secure.
ED 24-01 directs all Federal Civilian Executive Branch (FCEB) agencies running Ivanti Connect Secure and Ivanti Policy Secure to:
- Implement the mitigations as detailed in the ED.
- Report indications of compromise to Cyber999.
- Remove compromised products from agency networks and follow the ED’s comprehensive instructions for restoring and bringing the products back into service.
- Apply the updates to the products within 48 hours of Ivanti releasing the updates.
- Provide Cyber999 with a report that includes:
- A complete inventory of all instances of Ivanti Connect Secure and Ivanti Policy Secure products on agency networks.
- Details on actions taken and results.
Although this directive is only for FCEB agencies, CISA strongly encourages all organizations to address the vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure. For additional details, see CISA’s Alert, [Ivanti Releases Security Update for Connect Secure and Policy Secure Gateways](https://www.cisa.gov/news-events/alerts/2024/01/10/ivanti-releases-security-update-connect-secure-and-policy-secure-gateways), which CISA will update with further mitigations and patches as these become available.
**2.0 Impact**
When exploited in tandem, these vulnerabilities allow a malicious threat actor to execute arbitrary commands on a vulnerable product. Ivanti has released a temporary mitigation through an XML file that can be imported into affected products to make necessary configuration changes until the permanent update is available.
**3.0 Affected Products**
Ivanti Connect Secure and Ivanti Policy Secure.
**4.0 Recommendations**
Agencies running affected products (Ivanti Connect Secure or Ivanti Policy Secure solutions) are required to perform the following tasks:
1. As soon as possible and no later than 11:59 pm EST on Monday January 22, 2024, download and import “mitigation.release.20240107.1.xml,” via Ivanti’s download portal, into the affected product. Note that the XML file, once imported, impacts or degrades a number of product management features. Agencies must carefully follow [Ivanti’s instructions](https://forums.ivanti.com/s/article/Recovery-Steps-
2. Immediately after importing the XML file, download and run Ivanti’s External Integrity Checker Tool. **Note:** Although newer versions of the affected software include an integrated internal integrity checker, agencies are required to download and run the **external** tool, regardless of the current version installed. Running the External Integrity Checker Tool will reboot the affected product.
3. If indications of compromise are detected:
1. Immediately report indications of compromise to Cyber999 through [[email protected]](/cdn-cgi/l/email-protection#6300060d1711020f23000a10024d070b104d040c15).
2. Remove compromised products from agency networks. Initiate incident analysis, preserve data from the compromised devices through the creation of forensic hard drive images, and hunt for indications of further compromise.
3. To bring a compromised product back into service, reset the device with the affected Ivanti solution software to factory default settings and download and import “mitigation.release.20240107.1.xml,” via Ivanti’s download portal, into the affected product. Note that importing the XML file may impact or degrade a number of product management features. Agencies must carefully follow [Ivanti’s instructions](https://forums.ivanti.com/s/article/Recovery-Steps-
To fully restore a compromised product and bring it back into service, agencies are also required to follow [Ivanti’s instructions](https://forums.ivanti.com/s/article/Recovery-Steps-
- Revoke and reissue any stored certificates.
- Reset the admin enable password.
- Reset stored API keys.
- Reset the password of any local user defined on the gateway, including service accounts used for auth server configuration(s).
Generally, we advise users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact the Cyber999 Incident Response Team through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
- <https://www.cisa.gov/news-events/alerts/2024/01/19/cisa-issues-emergency-directive-ivanti-vulnerabilities>
- <https://www.cisa.gov/news-events/directives/ed-24-01-mitigate-ivanti-connect-secure-and-ivanti-policy-secure-vulnerabilities>