CVE-2024-10644: 
Ivanti Connect Secure vulnerability analysis and mitigation

Code injection vulnerability (CVE-2024-10644) affects Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3. The vulnerability allows a remote authenticated attacker with admin privileges to achieve remote code execution on affected systems. This critical vulnerability has been assigned a CVSS score of 9.1 (Hacker News, Censys).

The vulnerability is classified as a code injection flaw (CWE-94) that specifically affects the administrative interface of Ivanti Connect Secure and Policy Secure products. It requires authentication and administrative privileges for successful exploitation, which represents a significant barrier to exploitation compared to unauthenticated vulnerabilities. The critical severity rating of CVSS 9.1 with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H indicates the potential for complete compromise of system confidentiality, integrity, and availability (NVD).

If successfully exploited, the vulnerability allows an authenticated attacker with administrative privileges to execute arbitrary code on the affected system. This could potentially lead to complete system compromise, allowing attackers to gain full control over the affected Ivanti Connect Secure or Policy Secure installations (Hacker News).

Ivanti has released security updates to address this vulnerability. Users are strongly advised to upgrade to Ivanti Connect Secure version 22.7R2.4 or later, and Ivanti Policy Secure version 22.7R1.3 or later. According to Censys data, there are approximately 33,232 exposed Ivanti Connect Secure and Ivanti CSA instances online, with 14,574 instances potentially vulnerable to this flaw (Censys, Hacker News).

Ivanti has acknowledged that its edge products have been targeted by sophisticated threat actors and is making efforts to improve its software security. The company has enhanced internal scanning, manual exploitation and testing capabilities, increased collaboration with the security ecosystem, and become a CVE Numbering Authority to better address security concerns (Hacker News).