CVE-2024-21887

Published Jan 12, 2024

Last updated 2 months ago

Overview

Description
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
Source
support@hackerone.com
NVD status
Analyzed
Products
connect_secure, policy_secure

Risk scores

CVSS 3.1

Type
Primary
Base score
9.1
Impact score
6
Exploitability score
2.3
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

CVSS 3.0

Type
Secondary
Base score
9.1
Impact score
6
Exploitability score
2.3
Vector string
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Ivanti Connect Secure and Policy Secure Command Injection Vulnerability
Exploit added on
Jan 10, 2024
Exploit action due
Jan 22, 2024
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

nvd@nist.gov
CWE-77
134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE-77

Social media

Hype score
Not currently trending
  1. 【独自】米国サイバーセキュリティ・社会基盤安全保障庁(CISA)の既知の悪用された脆弱性が更新。以下脆弱性でランサムウェアによる悪用が確認された。 - WindowsのCVE-2024-21412 - IvantiのCVE-2024-21893, CVE-2023-46805, CV

    @__kokumoto

    8 Oct 2025

    1070 Impressions

    3 Retweets

    1 Like

    1 Bookmark

    0 Replies

    0 Quotes

  2. IVANTI ZERO-DAY CRISIS! Critical flaws in Connect/Policy Secure (CVE-2023-46805 & CVE-2024-21887) are being ACTIVELY EXPLOITED for Unauthenticated RCE. This is a full network breach threat. Read full report on - https://t.co/cu4YvjqoWz https://t.co/n8rC17wf5n

    @Iambivash007

    29 Sept 2025

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Actively exploited CVE : CVE-2024-21887

    @transilienceai

    16 Sept 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  4. Actively exploited CVE : CVE-2024-21887

    @transilienceai

    12 Sept 2025

    68 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  5. Actively exploited CVE : CVE-2024-21887

    @transilienceai

    10 Sept 2025

    74 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  6. Actively exploited CVE : CVE-2024-21887

    @transilienceai

    9 Sept 2025

    61 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  7. Actively exploited CVE : CVE-2024-21887

    @transilienceai

    8 Sept 2025

    89 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  8. Actively exploited CVE : CVE-2024-21887

    @transilienceai

    7 Sept 2025

    85 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  9. Actively exploited CVE : CVE-2024-21887

    @transilienceai

    5 Sept 2025

    71 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  10. ⚠️ Weekly vuln radar. https://t.co/Cd6L8ACyLV – spot what’s trending before it’s everywhere: CVE-2025-53770 CVE-2025-43300 CVE-2025-5777 CVE-2024-21887 CVE-2023-46604 (@ThreatBookLabs) CVE-2025-7776 CVE-2025-54309 CVE-2025-7775 CVE-2025-53771 https://t.co/q4Rx5wWFSt

    @ptdbugs

    29 Aug 2025

    286 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. Salt Typhoon hacking campaigns, linked to Chinese tech firms aiding government espionage, target global networks exploiting vulnerabilities like CVE-2018-0171 and CVE-2024-21887 for persistent access. #SaltTyphoon #China #CyberEspionage https://t.co/n11kIF3igk

    @TweetThreatNews

    27 Aug 2025

    145 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  12. Patching later? Pioneer Kitten Airbnb’d your Ivanti VPN (CVE-2024-21887) to BlackCat—crypto rent due at noon. Iran-2025 brief lists the next firewall CVEs primed to explode. Read / subscribe ↓ https://t.co/C3ms4aTMTi #AlphaHunt #CyberSecurity #ThreatIntel

    @alphahunt_io

    6 Aug 2025

    86 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. نسخه جدید باج افزار DragonForce منتشر شده است که از آسیب پذیری هایی با کدهای شناسایی CVE-2021-44228 و CVE-2023-46805 و CVE-2024-21887 استفاده می کند. برای حفظ دسترسی خود از بدافزاری

    @AmirHossein_sec

    10 May 2025

    80 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. Ivanti Connect SecureのCVE-2025-0282はMandiant曰く24/12/24頃から悪用されており25/1/8にパッチリリース https://t.co/iN0IZfGf0G 去年大騒ぎになった同じくIvanti/Pulse Connect Secure のゼロデイ CVE-2024-21887、CVE-2023-46805も23/12から攻撃があり翌年1/10以降に対策リリース… https://t.co/qp3L0ryDAT

    @nekono_naha

    9 Jan 2025

    1106 Impressions

    4 Retweets

    11 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  15. Cybersecurity WOTW: Spray Attacks Actively Exploited Vulnerabilities Include: • Cleo File Upload (CVE-2024-50623) • Microsoft CLFS Buffer Overflow (CVE-2024-49138) • Ivanti Connect Secure Command Injection (CVE-2024-21887) 👉Read the blog: https://t.co/mLYWd1ZfIJ https://t.co/

    @GradientCyber

    16 Dec 2024

    56 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. CVE-2024-21887 and More: How Earth Estries APT Group Exploits VPNs & Servers Learn about the Earth Estries APT group, a significant cyber espionage actor targeting critical sectors and industries worldwide. https://t.co/yAoI34DRVW

    @the_yellow_fall

    27 Nov 2024

    354 Impressions

    2 Retweets

    9 Likes

    6 Bookmarks

    0 Replies

    0 Quotes

Configurations