InfoSecBulletin Cybersecurity for mankind
The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have released a joint Cybersecurity Advisory to highlight the active exploitation of severe vulnerabilities in Ivanti Cloud Service Appliances (CSA). The vulnerabilities—CVE-2024-8963, CVE-2024-9379, CVE-2024-8190, and CVE-2024-9380—were targeted by threat actors in September 2024, leading to compromises of victim networks.
The vulnerabilities being exploited include:
CVE-2025-1268
Patch urgently! Canon Fixes Critical Printer Driver Flaw
Within Minute, RamiGPT To Escalate Privilege Gaining Root Access
Australian fintech database exposed in 27000 records
Over 200 Million Info Leaked Online Allegedly Belonging to X
FBI investigating cyberattack at Oracle, Bloomberg News reports
OpenAI Offering $100K Bounties for Critical Vulns
Splunk Alert User RCE and Data Leak Vulns
CIRT alert Situational Awareness for Eid Holidays
Cyberattack on Malaysian airports: PM rejected $10 million ransom
Micropatches released for Windows zero-day leaking NTLM hashes
CVE-2024-8963: An administrative bypass vulnerability (Path Traversal) that allows unauthorized access to restricted features of the appliance.
CVE-2024-8190: An OS command injection vulnerability enabling threat actors to authenticate remotely and execute arbitrary commands.
CVE-2024-9379: A SQL injection vulnerability permitting attackers with administrative privileges to run malicious SQL statements.
CVE-2024-9380: A command injection vulnerability allowing remote code execution (RCE) when exploited by attackers with admin privileges.
Affected Versions:
Vulnerabilities CVE-2024-8963, CVE-2024-8190, and CVE-2024-9380 impact Ivanti CSA 4.6x versions prior to build 519.CVE-2024-9379 and CVE-2024-9380 additionally affect CSA versions 5.0.1 and below.
It’s important to note that Ivanti CSA 4.6 has reached its end-of-life (EOL) and no longer receives security patches or updates. Users of version 4.6 are strongly encouraged to upgrade to a supported version to reduce these security risks.
CISA and FBI recommend upgrading to the latest supported Ivanti CSA version, deploying Endpoint Detection and Response (EDR) solutions, logging network activity to spot suspicious behavior, and ensuring regular patching of operating systems, software, and firmware within 24-48 hours of vulnerability disclosures.
