CISA Warns of Critical Auth Bypass in Network Thermostat X-Series

CISA Issues Emergency Directive on Active Exploitation of Ivanti App VPN Vulnerabilities WASHINGTON, Feb 2 (Reuters) – The U.S. Cybersecurity and Infrastructure Security Agency issued an emergency directive late Thursday warning that critical vulnerabilities in Ivanti Connect Secure and Ivanti Policy Secure VPN solutions are being actively exploited.

“We have confirmed that multiple threat actors—including known state-sponsored groups—are exploiting these vulnerabilities to gain access to both government and private sector networks,” CISA reported on two vulnerabilities under active exploit: CVE-2023-46805 (Authentication Bypass Vulnerability) and CVE-2024-21887 (Command Injection Vulnerability).

Attackers are able to chain these flaws together, bypass authentication protections, and run commands giving them total control of the targeted VPN appliances. CISA then observed attacks in which the vulnerability was used to drop malicious payloads, credential theft, and persistence mechanisms onto systems.

When and Where? CISA released a directive on February 2, 2024, following reports of recent attacks that go back to early January. Victims include U.S. government agencies and global enterprises. This is evidence of intrusion motivated by espionage.

Why does this matter? VPN appliances are high-value targets because successful exploitation can compromise remote access security. Successful exploitation enables attackers to bypass multi-factor authentication (MFA) and facilitates privileged lateral network movements inside the systems. Unpatched systems are under extreme risk of compromise, as warned by CISA.

Official Guidance CISA has directed Federal Agencies: 1. To apply Ivanti’s mitigation patches immediately or disconnect vulnerable systems. 2. To assume compromise and carry out forensic investigations.

3. To monitor for IOCs listed in CISA’s advisory. Ivanti released interim mitigations as it tried to work out final patches. The FBI and NSA are also involved in tracking threats against this vulnerability.

No specific hacker groups were made publicly known in the advisory. Next Steps: Organizations are urged to review CISA’s Emergency Directive ED 24-02 and read Ivanti’s security updates. If not, massive breaches will occur just as it happened last time during the 2021 Pulse Secure VPN compromises.