Known Exploited Vulnerability
9.8
CRITICAL
CVE-2024-7593
Ivanti Virtual Traffic Manager Authentication Bypa - [Actively Exploited]
Description

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

INFO

Published Date :

Aug. 13, 2024, 7:15 p.m.

Last Modified :

Sept. 25, 2024, 1 a.m.

Source :

3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
CISA Notification
CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Description :

Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 ; https://nvd.nist.gov/vuln/detail/CVE-2024-7593

Public PoC/Exploit Available at Github

CVE-2024-7593 has a 12 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-7593 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Ivanti virtual_traffic_management
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-7593.

URL Resource
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 Mitigation Patch Vendor Advisory

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

CVE-2024-7593 Ivanti Virtual Traffic Manager 22.2R1 / 22.7R2 Admin Panel Authentication Bypass PoC [EXPLOIT]

Shell

Updated: 1 week, 3 days ago
6 stars 1 fork 1 watcher
Born at : Sept. 24, 2024, 10:24 p.m. This repo has been linked 1 different CVEs too.

None

Updated: 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 9, 2024, 1:28 a.m. This repo has been linked 128 different CVEs too.

None

HTML

Updated: 4 weeks ago
0 stars 0 fork 0 watcher
Born at : Sept. 4, 2024, 9:24 a.m. This repo has been linked 128 different CVEs too.

Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.

0day ivanti cyber-security nuclei

Updated: 1 month, 1 week ago
0 stars 0 fork 0 watcher
Born at : Aug. 28, 2024, 10:02 a.m. This repo has been linked 2 different CVEs too.

CVE-2024-7593 < Ivanti vTM [Authentication Bypass]

codeb0ss ivanti cve-2024-7593 cve-2024-7593-exp cve-2024-7593-poc ivantivtm

Python

Updated: 1 month ago
2 stars 1 fork 1 watcher
Born at : Aug. 26, 2024, 11:03 a.m. This repo has been linked 1 different CVEs too.

News API is a simple tool for scraping news data. It returns the news title, description, and more.

Python

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : May 25, 2024, 9:36 a.m. This repo has been linked 1 different CVEs too.

News API is a simple tool for scraping news data. It returns the news title, description, and more.

JavaScript

Updated: 1 month, 2 weeks ago
0 stars 0 fork 0 watcher
Born at : May 13, 2024, 4:20 p.m. This repo has been linked 1 different CVEs too.

漏洞文库 wiki.wy876.cn

HTML

Updated: 3 weeks, 3 days ago
328 stars 61 fork 61 watcher
Born at : Dec. 31, 2023, 7:18 a.m. This repo has been linked 5 different CVEs too.

收集整理漏洞EXP/POC,大部分漏洞来源网络,目前收集整理了1000多个poc/exp,长期更新。

Updated: 4 weeks, 1 day ago
3420 stars 699 fork 699 watcher
Born at : Aug. 19, 2023, 12:08 p.m. This repo has been linked 125 different CVEs too.

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 1 month ago
516 stars 32 fork 32 watcher
Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1181 different CVEs too.

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 4 weeks, 1 day ago
6375 stars 1107 fork 1107 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 904 different CVEs too.

爬取secwiki和xuanwu.github.io/sec.today,分析安全信息站点、安全趋势、提取安全工作者账号(twitter,weixin,github等)

Python HTML

Updated: 1 month ago
1137 stars 202 fork 202 watcher
Born at : Feb. 19, 2019, 10:24 a.m. This repo has been linked 11 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-7593 vulnerability anywhere in the article.

  • Cybersecurity News
Okta Patches Vulnerability Allowing Unauthorized Access

Identity and access management giant, Okta, recently addressed a vulnerability that could have allowed malicious actors with valid credentials to bypass critical security measures. The vulnerability, ... Read more

Published Date: Oct 05, 2024 (2 days, 22 hours ago)
  • The Hacker News
Ivanti Endpoint Manager Flaw Actively Targeted, CISA Warns Agencies to Patch

Vulnerability / Endpoint Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Wednesday added a security flaw impacting Endpoint Manager (EPM) that the company patched in May t ... Read more

Published Date: Oct 03, 2024 (4 days, 18 hours ago)
  • Cybersecurity News
CVE-2024-8940 (CVSS 10): Critical Flaw in Scriptcase Low-Code Platform Leaves Developers at Risk

Developers using the popular low-code platform Scriptcase are urged to update their software immediately after discovering three critical vulnerabilities that could expose their applications to seriou ... Read more

Published Date: Oct 02, 2024 (5 days, 22 hours ago)
  • TheCyberThrone
TheCyberThrone Security Week In Review – September 28, 2024

Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings. This review is for the week ending Saturday, September 28, 2024.FreeBSD flagged with a ... Read more

Published Date: Sep 30, 2024 (1 week ago)
  • The Register
Forget the Kia Boyz: Hackers could hijack your car with just a smartphone

Infosec In Brief Put away that screwdriver and USB charging cable – the latest way to steal a Kia just requires a cellphone and the victim's license plate number. Sam Curry, who previously demonstrate ... Read more

Published Date: Sep 30, 2024 (1 week ago)
  • Cybersecurity News
CVE-2024-8353 (CVSS 10): Critical GiveWP Flaw, 100k WordPress Sites at Risk

A critical vulnerability has been discovered in the popular GiveWP donation plugin for WordPress, potentially allowing unauthenticated attackers to take complete control of affected websites. The flaw ... Read more

Published Date: Sep 30, 2024 (1 week ago)
  • Help Net Security
Week in review: Windows Server 2025 gets hotpatching option, PoC for SolarWinds WHD flaw released

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Windows Server 2025 gets hotpatching option, without reboots Organizations that plan to upgrade to Win ... Read more

Published Date: Sep 29, 2024 (1 week, 1 day ago)
  • TheCyberThrone
CUPS Vulnerability affecting Linux Print Server

There’s has been a spotlight on one of the vulnerability reported critical unauthenticated remote code execution flaws affecting Linux systems.Security researcher Simone Margaritelli discovered this v ... Read more

Published Date: Sep 27, 2024 (1 week, 3 days ago)
  • TheCyberThrone
VLC Player Vulnerability CVE-2024-46461

VLC media player has been traced with a vulnerability that could allow malicious actors to crash the program or even execute arbitrary code.The vulnerability tracked as CVE-2024-46461, with a CVSS sco ... Read more

Published Date: Sep 27, 2024 (1 week, 3 days ago)
  • TheCyberThrone
TeamViewer Fixes CVE-2024-7479 and CVE-2024-7481

TeamViewer has addressed two critical vulnerabilities impacting its Remote Client and Remote Host products for Windows.The vulnerabilities tracked as CVE-2024-7479 and CVE-2024-7481 both with a CVSS s ... Read more

Published Date: Sep 26, 2024 (1 week, 4 days ago)
  • Cybersecurity News
FlashArray, FlashBlade at Risk: Pure Storage Reveals CVSS 10 Vulnerabilities

Pure Storage has released a critical security advisory detailing multiple high-severity vulnerabilities impacting its FlashArray and FlashBlade storage systems. These vulnerabilities, some with a maxi ... Read more

Published Date: Sep 26, 2024 (1 week, 4 days ago)
  • Dark Reading
Third Ivanti Bug Comes Under Active Exploit, CISA Warns

Source: Kristoffer Tripplaar via Alamy Stock PhotoThe Cybersecurity and Infrastructure Security Agency (CISA) has added a third Ivanti vulnerability to the agency's Known Exploited Vulnerabilities (KE ... Read more

Published Date: Sep 25, 2024 (1 week, 5 days ago)
  • Help Net Security
PoC for critical SolarWinds Web Help Desk vulnerability released (CVE-2024-28987)

Details about and proof-of-concept (PoC) exploit code for CVE-2024-28987, a recently patched SolarWinds Web Help Desk (WHD) vulnerability that could be exploited by unauthenticated attackers to remote ... Read more

Published Date: Sep 25, 2024 (1 week, 5 days ago)
  • Help Net Security
Ivanti vTM auth bypass flaw exploited in attacks, CISA warns (CVE-2024-7593)

CVE-2024-7593, a critical authentication bypass vulnerability affecting Ivanti Virtual Traffic Manager (vTM) appliances, is actively exploited by attackers. The confirmation comes from the Cybersecuri ... Read more

Published Date: Sep 25, 2024 (1 week, 5 days ago)
  • TheCyberThrone
CISA adds Ivanti CVE-2024-7593 to its KEV Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added Ivanti Virtual Traffic Manager authentication bypass vulnerability CVE-2024-7593 with a CVSS score 9.8 to its Known Exploited Vul ... Read more

Published Date: Sep 25, 2024 (1 week, 5 days ago)
  • The Hacker News
CISA Flags Critical Ivanti vTM Vulnerability Amid Active Exploitation Concerns

Vulnerability / Cyber Attack The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday added a critical security flaw impacting Ivanti Virtual Traffic Manager (vTM) to its Known Expl ... Read more

Published Date: Sep 25, 2024 (1 week, 5 days ago)
  • Cybersecurity News
30 Exploitable Flaws: Alarming Study on Home Router Defaults

A study titled “Exposed by Default: A Security Analysis of Home Router Default Settings” has shed light on the pervasive vulnerabilities present in home routers, highlighting significant risks associa ... Read more

Published Date: Sep 25, 2024 (1 week, 5 days ago)
  • BleepingComputer
Critical Ivanti vTM auth bypass bug now exploited in attacks

CISA has tagged another critical Ivanti security vulnerability, which can let threat actors create rogue admin users on vulnerable Virtual Traffic Manager (vTM) appliances, as actively exploited in at ... Read more

Published Date: Sep 24, 2024 (1 week, 6 days ago)
  • security.nl
VS meldt actief misbruik van kritiek lek in Ivanti Virtual Traffic Manager

Aanvallers maken actief misbruik van een kritieke kwetsbaarheid in Ivanti Virtual Traffic Manager waarvoor vorige maand updates verschenen. Dat meldt het Cybersecurity and Infrastructure Security Agen ... Read more

Published Date: Sep 24, 2024 (1 week, 6 days ago)
  • Cybersecurity News
CISA Warns of Actively Exploited Ivanti vTM Flaw CVE-2024-7593 (CVSS 9.8), PoC Published

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent advisory regarding an actively exploited security vulnerability impacting Ivanti Virtual Traffic Manager (vTM), a ... Read more

Published Date: Sep 24, 2024 (1 week, 6 days ago)
  • Cybersecurity News
Unmasking “Marko Polo”: The Infostealer Gang Targeting Thousands

Marko Polo infection chain (Source: Recorded Future)Researchers at Recorded Future have uncovered a large-scale cyberattack affecting tens of thousands of devices worldwide. It was later revealed that ... Read more

Published Date: Sep 20, 2024 (2 weeks, 3 days ago)
  • Cybersecurity News
CISA Flags Two Actively Exploited Vulnerabilities: Critical Threats to Windows and WhatsUp Gold

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, adding two actively exploited security flaws to its Known Exploited Vulnerabilities (KEV) catalog, urging immedia ... Read more

Published Date: Sep 17, 2024 (2 weeks, 6 days ago)
  • Cybersecurity News
Exploit Kits, Cryptominers, Proxyjackers: The New Face of Selenium Grid Abuse

Researchers at Cado Security Labs have uncovered two malicious campaigns that exploit misconfigured instances of Selenium Grid. Once a trusted tool for browser automation and testing, Selenium Grid ha ... Read more

Published Date: Sep 17, 2024 (2 weeks, 6 days ago)
  • Cybersecurity News
Revival Hijack: A New PyPI Hijacking Technique Threatens Thousands of Packages

The JFrog security research team has uncovered a novel PyPI package hijacking method known as “Revival Hijack,” which has put over 22,000 packages at risk of exploitation. Unlike traditional typosquat ... Read more

Published Date: Sep 05, 2024 (1 month ago)
  • europa.eu
Cyber Brief 24-09 - August 2024

Cyber Brief (August 2024)September 4, 2024 - Version: 1.0TLP:CLEARExecutive summaryWe analysed 249 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, in Europe, th ... Read more

Published Date: Sep 04, 2024 (1 month ago)
  • Cybersecurity News
CVE-2024-38811: Code Execution Vulnerability Discovered in VMware Fusion

A high-severity security vulnerability (CVE-2024-38811, CVSS 8.8) has been identified in VMware Fusion, a popular virtualization software for macOS. The vulnerability, discovered by Mykola Grymalyuk o ... Read more

Published Date: Sep 03, 2024 (1 month ago)
  • Cybersecurity News
CVE-2024-7593 (CVSS 9.8): Critical Ivanti vTM Flaw Now Weaponized, PoC Exploit Available

A critical authentication bypass vulnerability, tracked as CVE-2024-7593 (CVSS 9.8), in Ivanti’s Virtual Traffic Manager (vTM), is now significantly easier to exploit thanks to the release of public p ... Read more

Published Date: Sep 03, 2024 (1 month ago)
  • Cybersecurity News
WikiLoader Malware Evolves with SEO Poisoning, Targets GlobalProtect Users

A cloned GlobalProtect page that directs users to download spoofed GlobalProtect installers | Image: Unit 42Please enable JavaScriptIn a recent investigation, the Unit 42 Managed Threat Hunting (MTH) ... Read more

Published Date: Sep 02, 2024 (1 month ago)
  • TheCyberThrone
CISA adds Jenkins bug CVE-2024-23897 to its KEV Catalog

The U.S. CISA added a Jenkins Command Line Interface (CLI) Path Traversal vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.Jenkins has addressed the vulnerability tracked as CVE-2024 ... Read more

Published Date: Aug 20, 2024 (1 month, 2 weeks ago)
  • TheCyberThrone
CISA adds Jenkins bug CVE-2024-23897 to its KEV Catalog

The U.S. CISA added a Jenkins Command Line Interface (CLI) Path Traversal vulnerability to its Known Exploited Vulnerabilities (KEV) catalog.Jenkins has addressed the vulnerability tracked as CVE-2024 ... Read more

Published Date: Aug 19, 2024 (1 month, 2 weeks ago)
  • TheCyberThrone
PoC for IvantiTM vulnerability CVE-2024-7593 released

To limit the exploitability of this vulnerability, Ivanti recommends limiting Admin Access to the Management Interface internal to the network through the private / corporate network.The researchers a ... Read more

Published Date: Aug 19, 2024 (1 month, 2 weeks ago)
  • Cyber Security News
Ivanti Virtual Traffic Manager Flaw Let Hackers Create Rogue Admin Accounts

Ivanti Virtual Traffic Manager has been discovered with a critical vulnerability which was associated with authentication bypass. This vulnerability has been assigned with CVE-2024-7593 and the severi ... Read more

Published Date: Aug 14, 2024 (1 month, 3 weeks ago)
  • The Hacker News
Critical Flaw in Ivanti Virtual Traffic Manager Could Allow Rogue Admin Access

Vulnerability / Network Security Ivanti has rolled out security updates for a critical flaw in Virtual Traffic Manager (vTM) that could be exploited to achieve an authentication bypass and create rogu ... Read more

Published Date: Aug 14, 2024 (1 month, 3 weeks ago)
  • BleepingComputer
Ivanti warns of critical vTM auth bypass with public exploit

​Today, Ivanti urged customers to patch a critical authentication bypass vulnerability impacting Virtual Traffic Manager (vTM) appliances that can let attackers create rogue administrator accounts. Iv ... Read more

Published Date: Aug 13, 2024 (1 month, 3 weeks ago)
  • Cybersecurity News
CVE-2024-7593 (CVSS 9.8): Authentication Bypass in Ivanti vTM: Proof of Concept Available

Ivanti has issued a security advisory addressing a critical vulnerability (CVE-2024-7593) in its Virtual Traffic Manager (vTM), a software-based Layer 7 application delivery controller (ADC). The flaw ... Read more

Published Date: Aug 13, 2024 (1 month, 3 weeks ago)
  • security.nl
Ivanti verhelpt kritieke kwetsbaarheden in Neurons en Virtual Traffic Manager

Softwarebedrijf Ivanti heeft vandaag beveiligingsupdates uitgebracht voor kritieke kwetsbaarheden in Ivanti Neurons for IT Service Management (ITSM) en Ivanti Virtual Traffic Manager en on-premise kla ... Read more

Published Date: Aug 13, 2024 (1 month, 3 weeks ago)

The following table lists the changes that have been made to the CVE-2024-7593 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE CISA KEV Update by 9119a7d8-5eab-497f-8521-727c672e3725

    Sep. 25, 2024

    Action Type Old Value New Value
    Added Due Date 2024-10-15
    Added Vulnerability Name Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
    Added Date Added 2024-09-24
    Added Required Action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  • Initial Analysis by [email protected]

    Sep. 06, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 No Types Assigned https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 Mitigation, Patch, Vendor Advisory
    Added CWE NIST CWE-287
    Added CPE Configuration OR *cpe:2.3:a:ivanti:virtual_traffic_management:22.2:*:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.3:-:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.3:r2:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.5:r1:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.6:r1:*:*:*:*:*:* *cpe:2.3:a:ivanti:virtual_traffic_management:22.7:r1:*:*:*:*:*:*
  • CVE Received by 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

    Aug. 13, 2024

    Action Type Old Value New Value
    Added Description Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
    Added Reference ivanti https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593 [No types assigned]
    Added CWE ivanti CWE-287
    Added CWE ivanti CWE-303
    Added CVSS V3.1 ivanti AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability