Ivanti has disclosed that a newly patched security flaw in its Cloud Service Appliance (CSA) is actively being exploited in the wild. The vulnerability, tracked as CVE-2024-8190, has a CVSS score of 7.2 and allows for remote code execution in specific conditions.
According to an advisory released earlier this week, Ivanti explained, "An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution." However, to exploit this flaw, the attacker must have admin-level privileges.
The vulnerability affects Ivanti CSA version 4.6, which has reached its end-of-life status. Customers using this version are urged to upgrade to a supported version for continued security. Ivanti addressed the issue in CSA 4.6 Patch 519, marking the final patch for the now-obsolete version.
"As the last fix for CSA 4.6, customers must upgrade to Ivanti CSA 5.0 for ongoing support," the Utah-based software company stated. The latest version, CSA 5.0, is not impacted by this vulnerability. Therefore, customers running CSA 5.0 are not required to take any further action.
On Friday, Ivanti updated its advisory, confirming that the flaw has been actively exploited in the wild, targeting a "limited number of customers." The company did not release details about the attacks or the threat actors involved, but previous vulnerabilities in Ivanti products have been used as zero-days by China-nexus cyberespionage groups.
In response to the ongoing attacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2024-8190 to its Known Exploited Vulnerabilities (KEV) catalog, mandating that federal agencies apply the necessary patches by October 4, 2024.
This disclosure follows the recent technical analysis by Horizon3.ai of another critical vulnerability, CVE-2024-29847, affecting Endpoint Manager (EPM). With a CVSS score of 10.0, this deserialization vulnerability also results in remote code execution, adding to the list of security concerns for Ivanti users.
