Ivanti warns customers to patch Connect Secure zero-day exploited in attacks

[Matt77]

Ivanti has told customers to patch immediately after attackers began exploiting a zero-day vulnerability in Ivanti Connect Secure, its SSL VPN gateway. BleepingComputer reports that the high severity flaw is an authentication bypass. Remote attackers who have not logged in can use it easily to run commands on the device

Affected versions are 22.8R2.4 and earlier, 25.1.2.2 and earlier, and 25.1.1.1 and earlier. The Shadowserver Foundation tracks more than 5,500 of these gateways exposed to the internet. Any organisation running Connect Secure should check its version straight away

Security firm Volexity reported the flaw. It says an unknown group it tracks as UTA0576 has been chaining it with two other bugs since at least 3 October to gain root access on fully patched devices. Another firm, Defused, saw exploitation starting on 1 October

The attackers were careful. They installed no malware, re-exploited the device for every command they ran, tampered with logs and avoided detection by Ivanti's Integrity Checker Tool. One of the privilege escalation bugs in the chain is still unpatched, which makes the situation more worrying

Ivanti VPN products have a difficult history. CISA has now flagged 36 exploited Ivanti flaws since 2021, and ransomware gangs have used 12 of them. VPN gateways sit right at the edge of a network, so they are prime targets, and fast patching plus close monitoring is essential

Is it time for organisations to move away from traditional VPN gateways? And how do you keep up with edge device patching?

Ivanti warns of Connect Secure zero-day exploited in attackswww.bleepingcomputer.com