Ivanti released a patch for a critical severity authentication bypass vulnerability and a warning that exploit code is publicly available

CVE-2024-7593: Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

Exploitation has been observed for this flaw. A proof-of-concept was available as of August 13. Organizations are strongly advised to apply the available patches.

With a public proof-of-concept and past targeting of Ivanti products, immediate patching is recommended for this authentication bypass flaw

Ivanti urges customers to patch a critical authentication bypass vulnerability. Proof-of-Concept is publicly available. Exploitation has not yet been observed

Ivanti Virtual Traffic Manager (vTM) versions before 22.2R1 and 22.x < 22.7R2 suffers from an authentication bypass vulnerability. By exploiting this vulnerability, a remote and unauthenticated attacker can access the administration panel and perform arbitrary modifications on the affected instance.

The version of Ivanti Virtual Traffic Manager (vTM) running on the remote host is 22.2 prior to 22.2R1, 22.3 prior to 22.3R3, 22.5 prior to 22.5R2, 22.6 prior to 22.6R2, or 22.7 prior to 22.7R2. It is, therefore, affected by an authentication bypass vulnerability:

  - Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a     remote unauthenticated attacker to bypass authentication of the admin panel. (CVE-2024-7593)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
114411	Ivanti Virtual Traffic Manager Authentication Bypass	Web App Scanning	Component Vulnerability	critical
205446	Ivanti Virtual Traffic Manager (vTM) 22.2 < 22.2R1 / 22.3 < 22.3R3 / 22.5 < 22.5R2 / 22.6 < 22.6R2 / 22.7 < 22.7R2 Authentication Bypass (CVE-2024-7593)	Nessus	CGI abuses	critical

Detections

Analytics

CVE-2024-7593

critical

Tenable Plugins

critical

critical