CVE-2024-22053: 
Ivanti Connect Secure vulnerability analysis and mitigation

CVE-2024-22053 is a heap overflow vulnerability affecting the IPSec component of Ivanti Connect Secure (versions 9.x, 22.x) and Ivanti Policy Secure. The vulnerability was disclosed on April 4, 2024, and received a CVSS v3.1 base score of 8.2 (High severity) (NVD).

The vulnerability is classified as an Out-of-bounds Write (CWE-787) that exists in the IPSec component. It allows an unauthenticated malicious user to send specially crafted requests that can lead to service disruption or memory content exposure. The vulnerability has received a CVSS v3.1 vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H, indicating network accessibility, low attack complexity, and no required privileges or user interaction (Hacker News).

The exploitation of this vulnerability can result in denial-of-service (DoS) attacks by crashing the service, and in certain conditions, attackers can read contents from memory. The high severity score reflects the potential for significant service disruption and unauthorized access to sensitive information (Hacker News).

As of the disclosure date, Ivanti has stated that there is no evidence of this vulnerability being exploited in the wild. The vulnerability requires no authentication and can be exploited remotely, making it potentially attractive to attackers (Ivanti Blog).

Ivanti has released patches for all supported versions of Ivanti Connect Secure and Policy Secure. An updated external ICT is also available for these updates. Customers are strongly advised to apply the available patches to mitigate the risk (Ivanti Blog).

Ivanti's CEO Jeff Abbott addressed the situation in an open letter on April 3, 2024, acknowledging that recent events have been humbling and announcing changes to their security operating model. The company is intensifying internal scanning, manual exploitation, and testing capabilities, while also engaging trusted third parties to augment their internal research (Hacker News).