CISA Warns of DLL Hijacking Flaw in Mitsubishi CNC Software (CVE-2016-2542)

The U.S. Cybersecurity and Infrastructure Security Agency issued an emergency directive against vulnerabilities being actively exploited in the products of Ivanti Connect Secure and Ivanti Policy Secure.

The federal agency confirmed that flaws are currently being leveraged by threat actors to infiltrate both federal and private sector networks.

In its warning, CISA highlighted that two vulnerabilities—the authentication bypass vulnerability CVE-2023-46805 and a command injection vulnerability CVE-2024-21887 are being exploited in the wild currently against broadly deployed VPN and network access control solutions made by Ivanti. Attackers can bypass authentication and execute malicious commands on systems they have unauthorized access to.

Who does it concern? Federal agencies, critical infrastructure operators, and enterprises that are users of Ivanti Connect Secure (previously operating under the name Pulse Secure) or Ivanti Policy Secure. CISA has gotten all federal civilian agencies to make sure mitigations are applied by February 5, 2024, and an exhaustive check of their networks for any present indicators of compromise.

When and Where. Exploitation was discovered in early January 2024, with intensified attacks in recent weeks. The victim pool encompasses a broad cross-section of industries—government, defense, and financial services included.

Specific targets in the U.S. or overseas have not been revealed by CISA; however, incidents were confirmed both domestically and internationally.

Exploitation paths discussed above lead to credential theft as well as malware execution followed by its persistence being maintained on a network. Unpatched systems are open to massive breaches if advanced persistent threats have their way. According to CISA warnings echoing Mandiant concerns, current campaigns are attributed to Chinese state-backed threat activity.

CISA urges organizations to: Apply Ivanti’s patches immediately. Disconnect compromised devices. Follow incident response steps outlined in its alert, Emergency Directive 24-01.

The FBI is assisting in investigations, while Ivanti has released mitigation tools for customers awaiting full patches. For ongoing updates, CISA directs organizations to its advisory at www.cisa.gov.