CVE-2024-21887
Summary
| CVE | CVE-2024-21887 |
|---|---|
| State | PUBLISHED |
| Assigner | hackerone |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2024-01-12 17:15:10 UTC |
| Updated | 2026-08-04 05:16:30 UTC |
| Description | A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance. |
Risk And Classification
Primary CVSS: v3.1 9.1 CRITICAL from [email protected]
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS: 0.999990000 probability, percentile 0.999990000 (date 2026-08-23)
CISA KEV: Listed on 2024-01-10; due 2024-01-22; ransomware use Known
Problem Types: CWE-77 | CWE-77 CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | [email protected] | Primary | 9.1 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| 3.0 | [email protected] | Secondary | 9.1 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
| 3.0 | CNA | DECLARED | 9.1 | CRITICAL | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CVSS v3.0 Breakdown
Attack Vector
NetworkAttack Complexity
LowPrivileges Required
HighUser Interaction
NoneScope
ChangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CISA Known Exploited Vulnerability
| Vendor | Ivanti |
|---|---|
| Product | Connect Secure and Policy Secure |
| Name | Ivanti Connect Secure and Policy Secure Command Injection Vulnerability |
| Required Action | Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. |
| Notes | Please apply mitigations per vendor instructions. For more information, please see: https://forums.ivanti.com/s/article/KB-CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US ; https://nvd.nist.gov/vuln/detail/CVE-2024-21887 |
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ivanti | Connect Secure | 22.1 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.1 | r6 | All | All |
| Application | Ivanti | Connect Secure | 22.2 | - | All | All |
| Application | Ivanti | Connect Secure | 22.2 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.3 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.4 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.4 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 22.5 | r2.1 | All | All |
| Application | Ivanti | Connect Secure | 22.6 | - | All | All |
| Application | Ivanti | Connect Secure | 22.6 | r1 | All | All |
| Application | Ivanti | Connect Secure | 22.6 | r2 | All | All |
| Application | Ivanti | Connect Secure | 9.0 | All | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r10 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.4 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r11.5 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r12 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r12.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r13 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r13.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r14 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r15 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r15.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r16 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r16.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r17 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r17.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r18 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r4.3 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r5 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r6 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r7 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.1 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r8.2 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9 | All | All |
| Application | Ivanti | Connect Secure | 9.1 | r9.1 | All | All |
| Application | Ivanti | Policy Secure | 22.1 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.1 | r6 | All | All |
| Application | Ivanti | Policy Secure | 22.2 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.2 | r3 | All | All |
| Application | Ivanti | Policy Secure | 22.3 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.3 | r3 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r2 | All | All |
| Application | Ivanti | Policy Secure | 22.4 | r2.1 | All | All |
| Application | Ivanti | Policy Secure | 22.5 | r1 | All | All |
| Application | Ivanti | Policy Secure | 22.5 | r2.1 | All | All |
| Application | Ivanti | Policy Secure | 22.6 | r1 | All | All |
| Application | Ivanti | Policy Secure | 9.0 | All | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r10 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r11 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r12 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r13 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r13.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r14 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r15 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r16 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r17 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r18 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r3 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r3.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r4.2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r5 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r6 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r7 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8.1 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r8.2 | All | All |
| Application | Ivanti | Policy Secure | 9.1 | r9 | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| www.cisa.gov/known-exploited-vulnerabilities-catalog | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | www.cisa.gov | US Government Resource |
| Ivanti Community | af854a3a-2127-422b-91ae-364da2661108 | forums.ivanti.com | Vendor Advisory |
| Ivanti Connect Secure Unauthenticated Remote Code Execution ≈ Packet Storm | af854a3a-2127-422b-91ae-364da2661108 | packetstormsecurity.com | Exploit, Third Party Advisory, VDB Entry |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
| CISA Known Exploited Vulnerabilities catalog | CISA | www.cisa.gov | kev |
No vendor comments have been submitted for this CVE.
Additional Advisory Data
| Source | Time | Event |
|---|---|---|
| ADP | 2024-01-10T00:00:00.000Z | CVE-2024-21887 added to CISA KEV |