onyx --cves cve-2024-21894
CVE-2024-21894
- score
- <0.1
- cvss
- 9.8
- epss
- 19.0%
- published
- 2024-04-04
- kev added
- 2024-10-30
- first seen
Ivanti Connect Secure 9.x, 22.x contains a heap overflow caused by crafted requests in the IPSec component, letting unauthenticated attackers crash the service and potentially execute arbitrary code, exploit requires sending specially crafted requests.
Timeline
How this CVE moved toward exploitation. Chart: last 30 days — trend score, EPSS, community mentions per day; hover the event lane.
- Published
- Added to CISA KEV
- Tracked by Onyx
Weaknesses
References 3
- https://forums.ivanti.com/s/article/SA-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
- https://cert.pl/uploads/docs/Report_CP_2024.pdf
- https://www.reliaquest.com/blog/5-critical-threat-actors-you-need-to-know-about/