CVE-2024-39710

Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

CVSS v3 9.1 CRITICAL

9.1^/10

CVSS v3 : CRITICAL

V3 Legend

Vector : AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Exploitability : 2.3 / Impact : 6.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ivanti:connect_secure::::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:-::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r1::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r1.1::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r1.2::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r1.3::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r1.4::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r1.5::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r2::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r2.1::::::
	cpe:2.3:a:ivanti:connect_secure:22.7:r2.2::::::
	cpe:2.3:a:ivanti:policy_secure::::::::
	cpe:2.3:a:ivanti:policy_secure:22.7:-::::::
	cpe:2.3:a:ivanti:policy_secure:22.7:r1::::::
	cpe:2.3:a:ivanti:policy_secure:22.7:r1.1::::::

History

11 Jul 2025, 13:54

Type	Values Removed	Values Added
First Time		Ivanti connect Secure Ivanti Ivanti policy Secure
References	~~() https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs -~~	() https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs - Vendor Advisory
CPE		cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:::::: cpe:2.3:a:ivanti:connect_secure:22.7:r2:::::: cpe:2.3:a:ivanti:policy_secure:::::::: cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:::::: cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:::::: cpe:2.3:a:ivanti:connect_secure:::::::: cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:::::: cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:::::: cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:::::: cpe:2.3:a:ivanti:connect_secure:22.7:r1:::::: cpe:2.3:a:ivanti:connect_secure:22.7:-:::::: cpe:2.3:a:ivanti:policy_secure:22.7:-:::::: cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:::::: cpe:2.3:a:ivanti:policy_secure:22.7:r1:::::: cpe:2.3:a:ivanti:policy_secure:22.7:r1.1::::::

01 Dec 2024, 19:15

Type	Values Removed	Values Added
Summary	(en) Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.7 allows a remote authenticated attacker with admin privileges to achieve remote code execution.	(en) Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

23 Nov 2024, 21:15

Type	Values Removed	Values Added
Summary	(en) Argument injection in Ivanti Connect Secure before version 22.7R2 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.	(en) Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.7 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

13 Nov 2024, 18:35

Type	Values Removed	Values Added
CWE		CWE-88

13 Nov 2024, 17:01

Type	Values Removed	Values Added
Summary		(es) La inyección de argumentos en Ivanti Connect Secure anterior a la versión 22.7R2 y 9.1R18.7 y en Ivanti Policy Secure anterior a la versión 22.7R1.1 permite que un atacante remoto autenticado con privilegios de administrador logre la ejecución remota de código.

13 Nov 2024, 02:15

Type	Values Removed	Values Added
New CVE

Information

Published : 2024-11-13 02:15

Updated : 2025-07-11 13:54

NVD link : CVE-2024-39710

Mitre link : CVE-2024-39710

CVE.ORG link : CVE-2024-39710

JSON object : View

Products Affected

ivanti

policy_secure
connect_secure

CWE

CWE-88

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

9.1 /10