CYPHERLOCK, INC.

Ivanti Virtual Traffic Manager Vulnerability Allows Hackers to Generate Unauthorized Admin Accounts

A critical flaw has been identified in Ivanti Virtual Traffic Manager, linked to authentication bypass issues. This vulnerability, cataloged as CVE-2024-7593, has been rated with a severity score of 9.8, classifying it as critical.

Ivanti has since addressed this vulnerability with a patch and issued a security advisory. The company has confirmed that there are no known cases of this vulnerability being actively exploited, although a proof of concept is publicly accessible.

Details of the Vulnerability:

The vulnerability allows an unauthenticated remote attacker to circumvent admin panel authentication, potentially enabling unauthorized actions. An attacker could also create a new administrator account on affected Ivanti instances, effectively establishing a backdoor.

This issue arises from an incorrect implementation of the authentication algorithm in Ivanti Virtual Traffic Manager. All versions prior to 22.2R1 and 22.7R2 are affected.

For users with management interfaces confined to an internal network or private IP, the risk is somewhat mitigated.

Mitigation and Recommendations:

Ivanti recommends users restrict access to the management interface by placing it behind a private IP with limited access. Users should also upgrade to the latest patched versions:

  • 22.2 to 22.2R1 (Available)
  • 22.3 to 22.3R3 (Patch available the week of August 19, 2024)
  • 22.3R2 to 22.3R3 (Patch available the week of August 19, 2024)
  • 22.5R1 to 22.5R2 (Patch available the week of August 19, 2024)
  • 22.6R1 to 22.6R2 (Patch available the week of August 19, 2024)
  • 22.7R1 to 22.7R2 (Available)

Workaround Instructions:

To limit Admin access temporarily, users should:

  1. Navigate to System > Security on the VTM server.
  2. Select the Management IP Address and Admin Server Port section.
  3. Click on the “bindip” dropdown and choose the Management Interface IP Address.
  4. Optionally, use the setting above “bindip” to restrict access to specific trusted IP addresses.

Users should review the “Audit Logs Output” to check for any unauthorized admin account additions.

Ivanti emphasizes keeping instances updated to the latest versions to avoid potential exploitation. For further information on support schedules and updates, users can refer to Ivanti’s End of Engineering and End of Support documentation.

Ivanti reassures that, prior to the public disclosure of this vulnerability, there were no known cases of exploitation. This information was shared through their responsible disclosure program.

More Articles & Posts

Scopes

2025 Active Exploitation AI Alert Analysis Attack Attackers Attacks Breach Breaches Campaigns China chrome CISA Cisco CISO CISOs credentials Critical Critical Flaw Critical Vulnerability CrowdStrike Cutting-Edge Cyber Attack Cyberattack cyberattacks Cybercriminals cybersecurity Cybersecurity Initiatives Cybersecurity Solutions Cyber Threats DDoS Attacks Discovered Enables Exploit Exploited Exploiting Exploits Exposes FBI Flaw Generative AI google Guide Hackers Hackers Exploit Healthcare Hijack Hit Insights Invest Ivanti Linux macOS malicious malware Massive data Breach MFA microsoft Microsoft 365 Microsoft Azure NIST Patch Phishing Phishing Attack PoC Privilege Escalation Ransomware Ransomware Attack ransomware attacks RCE RCE Vulnerability Released Remote Code Execution Researchers risk Scam security Security Flaw Strategies Strategy Systems Target Targeted Targeting Targets Threat Actors Threat Intelligence threats UK Unauthorized Code Execution Under Attack Users vulnerabilities Vulnerability WhatsApp windows Windows 11 Windows Systems Zero-Day