CVE-2024-21894: 
Ivanti Connect Secure vulnerability analysis and mitigation

A heap overflow vulnerability (CVE-2024-21894) was identified in the IPSec component of Ivanti Connect Secure (versions 9.x, 22.x) and Ivanti Policy Secure. The vulnerability was disclosed on April 4, 2024, and allows an unauthenticated malicious user to send specially crafted requests that can crash the service, resulting in a denial of service (DoS) attack (NVD).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) and Improper Check or Handling of Exceptional Conditions (CWE-703). It received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H from NIST, while HackerOne assigned it a score of 8.2 (HIGH) with vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H (NVD).

The vulnerability can lead to service disruptions through denial of service attacks. Under certain conditions, it may also enable the execution of arbitrary code on affected systems (NVD).

The vulnerability can be exploited remotely by an unauthenticated attacker by sending specially crafted requests to the IPSec component of affected systems (NVD).

Affected organizations should upgrade their Ivanti Connect Secure and Ivanti Policy Secure installations to the latest patched versions. The vulnerability affects versions 9.x and 22.x of both products (Rapid7).