CVE-2024-22052: 
Ivanti Connect Secure vulnerability analysis and mitigation

A null pointer dereference vulnerability (CVE-2024-22052) was identified in the IPSec component of Ivanti Connect Secure (versions 9.x, 22.x) and Ivanti Policy Secure. The vulnerability was disclosed on April 4, 2024, and received a CVSS v3.1 base score of 7.5 (High) (NVD).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) and Improper Check or Handling of Exceptional Conditions (CWE-703). It allows an unauthenticated attacker to send specially crafted requests to the IPSec component. The vulnerability has been assigned a CVSS vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

When successfully exploited, this vulnerability can cause the service to crash, resulting in a Denial of Service (DoS) attack. The high availability impact (A:H) in the CVSS score indicates that the vulnerability can cause a complete loss of availability of the affected component (NVD).

The vulnerability can be exploited remotely by an unauthenticated attacker through specially crafted requests to the IPSec component. The low attack complexity (AC:L) suggests that the vulnerability is relatively straightforward to exploit (NVD).

Affected organizations should refer to Ivanti's security advisory for detailed mitigation instructions and available patches (Ivanti Advisory).