Known Exploited Vulnerability
9.8
CRITICAL
CVE-2024-7593
Ivanti Virtual Traffic Manager Authentication Bypa - [Actively Exploited]
Description

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

INFO

Published Date :

Aug. 13, 2024, 7:15 p.m.

Last Modified :

Sept. 25, 2024, 1 a.m.

Source :

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 ; https://nvd.nist.gov/vuln/detail/CVE-2024-7593

Public PoC/Exploit Available at Github

CVE-2024-7593 has a 13 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-7593 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Ivanti virtual_traffic_management
: Total Affected Vendor : 1 | Products : 1
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-7593.

URL Resource
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 Mitigation Patch Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Profile Photo
skyrowalker/CVE-2024-7593

None

Updated: 1 month ago
0 stars 0 fork 0 watcher
Born at : Oct. 12, 2024, 2:17 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
D3N14LD15K/CVE-2024-7593_PoC_Exploit

CVE-2024-7593 Ivanti Virtual Traffic Manager 22.2R1 / 22.7R2 Admin Panel Authentication Bypass PoC [EXPLOIT]

Shell

Updated: 1 month, 2 weeks ago
6 stars 1 fork 1 watcher
Born at : Sept. 24, 2024, 10:24 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
admin772/POC

None

Updated: 2 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Sept. 9, 2024, 1:28 a.m. This repo has been linked 128 different CVEs too.
Profile Photo
WhosGa/MyWiki

None

HTML

Updated: 2 months, 1 week ago
0 stars 0 fork 0 watcher
Born at : Sept. 4, 2024, 9:24 a.m. This repo has been linked 128 different CVEs too.
Profile Photo
rxerium/CVE-2024-7593

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

0day ivanti cyber-security nuclei

Updated: 2 months, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : Aug. 28, 2024, 10:02 a.m. This repo has been linked 2 different CVEs too.
Profile Photo
codeb0ss/CVE-2024-7593-PoC

CVE-2024-7593 < Ivanti vTM [Authentication Bypass]

codeb0ss ivanti cve-2024-7593 cve-2024-7593-exp cve-2024-7593-poc ivantivtm

Python

Updated: 2 months, 1 week ago
2 stars 1 fork 1 watcher
Born at : Aug. 26, 2024, 11:03 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
apiverve/news.Python-API

News API is a simple tool for scraping news data. It returns the news title, description, and more.

Python

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : May 25, 2024, 9:36 a.m. This repo has been linked 1 different CVEs too.
Profile Photo
apiverve/news-API

News API is a simple tool for scraping news data. It returns the news title, description, and more.

JavaScript

Updated: 2 months, 3 weeks ago
0 stars 0 fork 0 watcher
Born at : May 13, 2024, 4:20 p.m. This repo has been linked 1 different CVEs too.
Profile Photo
wy876/wiki

漏洞文库 wiki.wy876.cn

HTML

Updated: 2 months ago
328 stars 61 fork 61 watcher
Born at : Dec. 31, 2023, 7:18 a.m. This repo has been linked 5 different CVEs too.
Profile Photo
wy876/POC

收集整理漏洞EXP/POC,大部分漏洞来源网络，目前收集整理了1000多个poc/exp，长期更新。

Updated: 2 months, 1 week ago
3420 stars 699 fork 699 watcher
Born at : Aug. 19, 2023, 12:08 p.m. This repo has been linked 125 different CVEs too.
Profile Photo
Ostorlab/KEV

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 months, 1 week ago
516 stars 32 fork 32 watcher
Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1181 different CVEs too.
Profile Photo
nomi-sec/PoC-in-GitHub

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 months, 1 week ago
6375 stars 1107 fork 1107 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 904 different CVEs too.
Profile Photo
tanjiti/sec_profile

爬取secwiki和xuanwu.github.io/sec.today,分析安全信息站点、安全趋势、提取安全工作者账号(twitter,weixin,github等)

Python HTML

Updated: 2 months, 1 week ago
1137 stars 202 fork 202 watcher
Born at : Feb. 19, 2019, 10:24 a.m. This repo has been linked 11 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-7593 vulnerability anywhere in the article.

  • Cybersecurity News
Critical Flaw in Synology Camera Firmware Expose Devices to RCE and DoS Attacks

Synology has issued a security advisory, Synology-SA-24:17, warning of critical vulnerabilities in several of its camera firmware products, including Synology Camera BC500, TC500, and CC400W. The vuln ... Read more

Published Date: Oct 19, 2024 (4 weeks, 1 day ago)
CVE-2024-9985 CVE-2024-9984 CVE-2024-9983 CVE-2024-9465 CVE-2024-20470 CVE-2024-20393 CVE-2024-7593 CVE-2023-5746 CVE-2023-25280 CVE-2022-43931 ...+1 more CVE
  • Cybersecurity News
Okta Patches Vulnerability Allowing Unauthorized Access

Identity and access management giant, Okta, recently addressed a vulnerability that could have allowed malicious actors with valid credentials to bypass critical security measures. The vulnerability, ... Read more

Published Date: Oct 05, 2024 (1 month, 1 week ago)
CVE-2024-37985 CVE-2024-43491 CVE-2024-40711 CVE-2024-7593 CVE-2024-0981 CVE-2023-25280
  • The Hacker News
Ivanti Endpoint Manager Flaw Actively Targeted, CISA Warns Agencies to Patch

Vulnerability / Endpoint Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Endpoint Manager (EPM) that the company patched in May t ... Read more

Published Date: Oct 03, 2024 (1 month, 2 weeks ago)
CVE-2024-8963 CVE-2024-8190 CVE-2024-7593 CVE-2024-29824
  • Cybersecurity News
CVE-2024-8940 (CVSS 10): Critical Flaw in Scriptcase Low-Code Platform Leaves Developers at Risk

Developers using the popular low-code platform Scriptcase are urged to update their software immediately after discovering three critical vulnerabilities that could expose their applications to seriou ... Read more

Published Date: Oct 02, 2024 (1 month, 2 weeks ago)
CVE-2024-8942 CVE-2024-8941 CVE-2024-8940 CVE-2023-27584 CVE-2024-8504 CVE-2024-8503 CVE-2024-7593
  • TheCyberThrone
TheCyberThrone Security Week In Review – September 28, 2024

Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the week ending Saturday, September 28, 2024.FreeBSD flagged with a ... Read more

Published Date: Sep 30, 2024 (1 month, 2 weeks ago)
CVE-2024-7481 CVE-2024-7479 CVE-2024-41721 CVE-2024-8986 CVE-2024-43917 CVE-2024-7593
  • The Register
Forget the Kia Boyz: Hackers could hijack your car with just a smartphone

Infosec In Brief Put away that screwdriver and USB charging cable – the latest way to steal a Kia just requires a cellphone and the victim's license plate number. Sam Curry, who previously demonstrate ... Read more

Published Date: Sep 30, 2024 (1 month, 2 weeks ago)
CVE-2024-7593
  • Cybersecurity News
CVE-2024-8353 (CVSS 10): Critical GiveWP Flaw, 100k WordPress Sites at Risk

A critical vulnerability has been discovered in the popular GiveWP donation plugin for WordPress, potentially allowing unauthenticated attackers to take complete control of affected websites. The flaw ... Read more

Published Date: Sep 30, 2024 (1 month, 2 weeks ago)
CVE-2024-8353 CVE-2024-37985 CVE-2024-43491 CVE-2024-40711 CVE-2024-5932 CVE-2024-7593 CVE-2024-5274 CVE-2024-4947
  • Help Net Security
Week in review: Windows Server 2025 gets hotpatching option, PoC for SolarWinds WHD flaw released

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Windows Server 2025 gets hotpatching option, without reboots Organizations that plan to upgrade to Win ... Read more

Published Date: Sep 29, 2024 (1 month, 2 weeks ago)
CVE-2024-28987 CVE-2024-7593
  • TheCyberThrone
CUPS Vulnerability affecting Linux Print Server

There’s has been a spotlight on one of the vulnerability reported critical unauthenticated remote code execution flaws affecting Linux systems.Security researcher Simone Margaritelli discovered this v ... Read more

Published Date: Sep 27, 2024 (1 month, 2 weeks ago)
CVE-2024-47177 CVE-2024-47176 CVE-2024-47175 CVE-2024-47076 CVE-2024-46461 CVE-2024-7481 CVE-2024-7479 CVE-2024-7593
  • TheCyberThrone
VLC Player Vulnerability CVE-2024-46461

VLC media player has been traced with a vulnerability that could allow malicious actors to crash the program or even execute arbitrary code.The vulnerability tracked as CVE-2024-46461, with a CVSS sco ... Read more

Published Date: Sep 27, 2024 (1 month, 3 weeks ago)
CVE-2024-46461 CVE-2024-7481 CVE-2024-7479 CVE-2024-7593
  • TheCyberThrone
TeamViewer Fixes CVE-2024-7479 and CVE-2024-7481

TeamViewer has addressed two critical vulnerabilities impacting its Remote Client and Remote Host products for Windows.The vulnerabilities tracked as CVE-2024-7479 and CVE-2024-7481 both with a CVSS s ... Read more

Published Date: Sep 26, 2024 (1 month, 3 weeks ago)
CVE-2024-7481 CVE-2024-7479 CVE-2024-8986 CVE-2024-7593
  • Cybersecurity News
FlashArray, FlashBlade at Risk: Pure Storage Reveals CVSS 10 Vulnerabilities

Pure Storage has released a critical security advisory detailing multiple high-severity vulnerabilities impacting its FlashArray and FlashBlade storage systems. These vulnerabilities, some with a maxi ... Read more

Published Date: Sep 26, 2024 (1 month, 3 weeks ago)
CVE-2024-0005 CVE-2024-0004 CVE-2024-0003 CVE-2024-0002 CVE-2024-0001 CVE-2024-9014 CVE-2024-45409 CVE-2024-20469 CVE-2024-20439 CVE-2024-6633 ...+1 more CVE
  • Dark Reading
Third Ivanti Bug Comes Under Active Exploit, CISA Warns

Source: Kristoffer Tripplaar via Alamy Stock PhotoThe Cybersecurity and Infrastructure Security Agency (CISA) has added a third Ivanti vulnerability to the agency's Known Exploited Vulnerabilities (KE ... Read more

Published Date: Sep 25, 2024 (1 month, 3 weeks ago)
CVE-2024-8963 CVE-2024-8190 CVE-2024-7593
  • Help Net Security
PoC for critical SolarWinds Web Help Desk vulnerability released (CVE-2024-28987)

Details about and proof-of-concept (PoC) exploit code for CVE-2024-28987, a recently patched SolarWinds Web Help Desk (WHD) vulnerability that could be exploited by unauthenticated attackers to remote ... Read more

Published Date: Sep 25, 2024 (1 month, 3 weeks ago)
CVE-2024-28987 CVE-2024-28986 CVE-2024-7593
  • Help Net Security
Ivanti vTM auth bypass flaw exploited in attacks, CISA warns (CVE-2024-7593)

CVE-2024-7593, a critical authentication bypass vulnerability affecting Ivanti Virtual Traffic Manager (vTM) appliances, is actively exploited by attackers. The confirmation comes from the Cybersecuri ... Read more

Published Date: Sep 25, 2024 (1 month, 3 weeks ago)
CVE-2024-8190 CVE-2024-7593 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805
  • TheCyberThrone
CISA adds Ivanti CVE-2024-7593 to its KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Ivanti Virtual Traffic Manager authentication bypass vulnerability CVE-2024-7593 with a CVSS score 9.8 to its Known Exploited Vul ... Read more

Published Date: Sep 25, 2024 (1 month, 3 weeks ago)
CVE-2024-41721 CVE-2024-8986 CVE-2024-8767 CVE-2024-7593
  • The Hacker News
CISA Flags Critical Ivanti vTM Vulnerability Amid Active Exploitation Concerns

Vulnerability / Cyber Attack The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting Ivanti Virtual Traffic Manager (vTM) to its Known Expl ... Read more

Published Date: Sep 25, 2024 (1 month, 3 weeks ago)
CVE-2024-8963 CVE-2024-8190 CVE-2024-7593
  • Cybersecurity News
30 Exploitable Flaws: Alarming Study on Home Router Defaults

A study titled “Exposed by Default: A Security Analysis of Home Router Default Settings” has shed light on the pervasive vulnerabilities present in home routers, highlighting significant risks associa ... Read more

Published Date: Sep 25, 2024 (1 month, 3 weeks ago)
CVE-2023-27584 CVE-2024-8504 CVE-2024-8503 CVE-2024-6386 CVE-2024-42815 CVE-2024-7593
  • BleepingComputer
Critical Ivanti vTM auth bypass bug now exploited in attacks

CISA has tagged another critical Ivanti security vulnerability, which can let threat actors create rogue admin users on vulnerable Virtual Traffic Manager (vTM) appliances, as actively exploited in at ... Read more

Published Date: Sep 24, 2024 (1 month, 3 weeks ago)
CVE-2024-7593
  • security.nl
VS meldt actief misbruik van kritiek lek in Ivanti Virtual Traffic Manager

Aanvallers maken actief misbruik van een kritieke kwetsbaarheid in Ivanti Virtual Traffic Manager waarvoor vorige maand updates verschenen. Dat meldt het Cybersecurity and Infrastructure Security Agen ... Read more

Published Date: Sep 24, 2024 (1 month, 3 weeks ago)
CVE-2024-7593
  • Cybersecurity News
CISA Warns of Actively Exploited Ivanti vTM Flaw CVE-2024-7593 (CVSS 9.8), PoC Published

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding an actively exploited security vulnerability impacting Ivanti Virtual Traffic Manager (vTM), a ... Read more

Published Date: Sep 24, 2024 (1 month, 3 weeks ago)
CVE-2024-8696 CVE-2024-8695 CVE-2024-29847 CVE-2024-8190 CVE-2024-7593 CVE-2024-38063 CVE-2024-36401 CVE-2024-5274 CVE-2024-4947
  • Cybersecurity News
Unmasking “Marko Polo”: The Infostealer Gang Targeting Thousands

Marko Polo infection chain (Source: Recorded Future)Researchers at Recorded Future have uncovered a large-scale cyberattack affecting tens of thousands of devices worldwide. It was later revealed that ... Read more

Published Date: Sep 20, 2024 (1 month, 4 weeks ago)
CVE-2024-37985 CVE-2024-8504 CVE-2024-8503 CVE-2024-6386 CVE-2024-7593 CVE-2024-38193
  • Cybersecurity News
CISA Flags Two Actively Exploited Vulnerabilities: Critical Threats to Windows and WhatsUp Gold

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, adding two actively exploited security flaws to its Known Exploited Vulnerabilities (KEV) catalog, urging immedia ... Read more

Published Date: Sep 17, 2024 (2 months ago)
CVE-2024-8504 CVE-2024-8503 CVE-2024-43461 CVE-2024-6671 CVE-2024-6670 CVE-2024-6386 CVE-2024-7593 CVE-2024-38193 CVE-2024-38112
  • Cybersecurity News
Exploit Kits, Cryptominers, Proxyjackers: The New Face of Selenium Grid Abuse

Researchers at Cado Security Labs have uncovered two malicious campaigns that exploit misconfigured instances of Selenium Grid. Once a trusted tool for browser automation and testing, Selenium Grid ha ... Read more

Published Date: Sep 17, 2024 (2 months ago)
CVE-2024-6386 CVE-2024-7593 CVE-2024-38193 CVE-2023-27532 CVE-2021-4043
  • Cybersecurity News
Revival Hijack: A New PyPI Hijacking Technique Threatens Thousands of Packages

The JFrog security research team has uncovered a novel PyPI package hijacking method known as “Revival Hijack,” which has put over 22,000 packages at risk of exploitation. Unlike traditional typosquat ... Read more

Published Date: Sep 05, 2024 (2 months, 1 week ago)
CVE-2024-6386 CVE-2024-7593 CVE-2024-38193 CVE-2024-6915 CVE-2024-38856 CVE-2024-0646
  • europa.eu
Cyber Brief 24-09 - August 2024

Cyber Brief (August 2024)September 4, 2024 - Version: 1.0TLP:CLEARExecutive summaryWe analysed 249 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, in Europe, th ... Read more

Published Date: Sep 04, 2024 (2 months, 1 week ago)
CVE-2024-40766 CVE-2024-7971 CVE-2024-5914 CVE-2024-28986 CVE-2024-7593 CVE-2024-41730 CVE-2024-38200 CVE-2024-22116 CVE-2023-31315 CVE-2024-1305 ...+3 more CVE
  • Cybersecurity News
CVE-2024-38811: Code Execution Vulnerability Discovered in VMware Fusion

A high-severity security vulnerability (CVE-2024-38811, CVSS 8.8) has been identified in VMware Fusion, a popular virtualization software for macOS. The vulnerability, discovered by Mykola Grymalyuk o ... Read more

Published Date: Sep 03, 2024 (2 months, 2 weeks ago)
CVE-2024-38811 CVE-2024-8073 CVE-2024-39809 CVE-2024-39792 CVE-2024-7593 CVE-2024-43044 CVE-2024-42222 CVE-2024-42062
  • Cybersecurity News
CVE-2024-7593 (CVSS 9.8): Critical Ivanti vTM Flaw Now Weaponized, PoC Exploit Available

A critical authentication bypass vulnerability, tracked as CVE-2024-7593 (CVSS 9.8), in Ivanti’s Virtual Traffic Manager (vTM), is now significantly easier to exploit thanks to the release of public p ... Read more

Published Date: Sep 03, 2024 (2 months, 2 weeks ago)
CVE-2024-8073 CVE-2024-39809 CVE-2024-39792 CVE-2024-7593 CVE-2024-43044 CVE-2024-42222 CVE-2024-42062 CVE-2023-38035
  • Cybersecurity News
WikiLoader Malware Evolves with SEO Poisoning, Targets GlobalProtect Users

A cloned GlobalProtect page that directs users to download spoofed GlobalProtect installers | Image: Unit 42Please enable JavaScriptIn a recent investigation, the Unit 42 Managed Threat Hunting (MTH) ... Read more

Published Date: Sep 02, 2024 (2 months, 2 weeks ago)
CVE-2024-8073 CVE-2024-39809 CVE-2024-39792 CVE-2024-7593 CVE-2024-43044 CVE-2024-42222 CVE-2024-42062 CVE-2021-3064
  • TheCyberThrone
CISA adds Jenkins bug CVE-2024-23897 to its KEV Catalog

The U.S. CISA added a Jenkins Command Line Interface (CLI) Path Traversal vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.Jenkins has addressed the vulnerability tracked as CVE-2024 ... Read more

Published Date: Aug 20, 2024 (2 months, 4 weeks ago)
CVE-2024-7971 CVE-2024-7593 CVE-2024-2024 CVE-2024-23897 CVE-2023-22527 CVE-2023-43770
  • TheCyberThrone
CISA adds Jenkins bug CVE-2024-23897 to its KEV Catalog

The U.S. CISA added a Jenkins Command Line Interface (CLI) Path Traversal vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.Jenkins has addressed the vulnerability tracked as CVE-2024 ... Read more

Published Date: Aug 19, 2024 (2 months, 4 weeks ago)
CVE-2024-7971 CVE-2024-7593 CVE-2024-2024 CVE-2024-23897 CVE-2023-22527 CVE-2023-43770
  • TheCyberThrone
PoC for IvantiTM vulnerability CVE-2024-7593 released

To limit the exploitability of this vulnerability, Ivanti recommends limiting Admin Access to the Management Interface internal to the network through the private / corporate network.The researchers a ... Read more

Published Date: Aug 19, 2024 (2 months, 4 weeks ago)
CVE-2024-7971 CVE-2024-7593 CVE-2024-23897 CVE-2023-22527 CVE-2023-35082
  • Cyber Security News
Ivanti Virtual Traffic Manager Flaw Let Hackers Create Rogue Admin Accounts

Ivanti Virtual Traffic Manager has been discovered with a critical vulnerability which was associated with authentication bypass. This vulnerability has been assigned with CVE-2024-7593 and the severi ... Read more

Published Date: Aug 14, 2024 (3 months ago)
CVE-2024-7593
  • The Hacker News
Critical Flaw in Ivanti Virtual Traffic Manager Could Allow Rogue Admin Access

Vulnerability / Network Security Ivanti has rolled out security updates for a critical flaw in Virtual Traffic Manager (vTM) that could be exploited to achieve an authentication bypass and create rogu ... Read more

Published Date: Aug 14, 2024 (3 months ago)
CVE-2024-38653 CVE-2024-38652 CVE-2024-37399 CVE-2024-37373 CVE-2024-36136 CVE-2024-7593 CVE-2024-7570 CVE-2024-7569
  • BleepingComputer
Ivanti warns of critical vTM auth bypass with public exploit

​Today, Ivanti urged customers to patch a critical authentication bypass vulnerability impacting Virtual Traffic Manager (vTM) appliances that can let attackers create rogue administrator accounts. Iv ... Read more

Published Date: Aug 13, 2024 (3 months ago)
CVE-2024-7593 CVE-2024-7570 CVE-2024-7569 CVE-2024-22024 CVE-2024-21893 CVE-2024-21887 CVE-2023-46805
  • Cybersecurity News
CVE-2024-7593 (CVSS 9.8): Authentication Bypass in Ivanti vTM: Proof of Concept Available

Ivanti has issued a security advisory addressing a critical vulnerability (CVE-2024-7593) in its Virtual Traffic Manager (vTM), a software-based Layer 7 application delivery controller (ADC). The flaw ... Read more

Published Date: Aug 13, 2024 (3 months ago)
CVE-2024-7593 CVE-2024-36268 CVE-2024-6457 CVE-2024-39891 CVE-2024-1200 CVE-2012-4792
  • security.nl
Ivanti verhelpt kritieke kwetsbaarheden in Neurons en Virtual Traffic Manager

Softwarebedrijf Ivanti heeft vandaag beveiligingsupdates uitgebracht voor kritieke kwetsbaarheden in Ivanti Neurons for IT Service Management (ITSM) en Ivanti Virtual Traffic Manager en on-premise kla ... Read more

Published Date: Aug 13, 2024 (3 months ago)
CVE-2024-7593 CVE-2024-7570 CVE-2024-7569

The following table lists the changes that have been made to the CVE-2024-7593 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Sep. 25, 2024

    Action Type Old Value New Value
    Added Due Date 2024-10-15
    Added Vulnerability Name Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
    Added Date Added 2024-09-24
    Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  • Initial Analysis by [email protected]

    Sep. 06, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 No Types Assigned https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 Mitigation, Patch, Vendor Advisory
    Added CWE NIST CWE-287
    Added CPE Configuration OR *cpe:2.3:a:ivanti:virtual_traffic_management:22.2:*:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.3:-:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.3:r2:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.5:r1:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.6:r1:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.7:r1:*:*:*:*:*:*
  • CVE Received by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

    Aug. 13, 2024

    Action Type Old Value New Value
    Added Description Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
    Added Reference ivanti https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 [No types assigned]
    Added CWE ivanti CWE-287
    Added CWE ivanti CWE-303
    Added CVSS V3.1 ivanti AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
: