CISA Warns of High-Risk Vulnerabilities in DuraComm DP-10iN-100-MU

The Cybersecurity and Infrastructure Security Agency, or CISA, has issued an emergency directive of active critical vulnerability exploitation against the Ivanti Connect Secure and Ivanti Policy Secure products. Attackers are exploiting these vulnerabilities to gain access to networks and exfiltrate sensitive information, as well as deliver malicious payloads.

According to the CISA alert, two vulnerabilities, identified as CVE-2023-46805 and CVE-2024-21887, allow pre-authentication command injection, enabling attackers to bypass authentication and execute arbitrary commands, thereby increasing access to the system. Federal agencies and private-sector organizations are being actively targeted, with threat actors leveraging these flaws, including state-sponsored groups, among others.

Who is at risk? Ivanti Connect Secure (originally Pulse Secure VPN) and Ivanti Policy Secure gateways. Any government agency, critical infrastructure operator, or enterprise that uses these products for remote access would be at immediate risk.

Attacks have been observed since early January 2024, with CISA confirming the massive exploitation by the end of January. Since then, incidents have occurred across a number of sectors—defense, healthcare, and financial services, among others.

Why does it matter? These vulnerabilities could allow bypasses of security controls, leading to devastating effects, including possible data exfiltration vulnerabilities, potential avenues for ransomware drops in the network, and numerous other avenues for further exploitation within a network environment.

Unpatched systems are highly vulnerable—the attackers are now scanning all exposed devices, according to CISA. Federal agencies have been required by CISA to take affected Ivanti products offline immediately, patch systems, and perform forensics.

The agency has also shared detection tools. Ivanti has released temporary mitigations and strongly recommends that customers patch as soon as possible. They acknowledge the seriousness of these flaws and are working with CISA on current threats.

Organizations must do the following steps that CISA recommended: Disconnect compromised Ivanti devices from networks; apply the latest patches and follow Ivanti mitigation steps; hunt for IOCs using tools provided by CISA.

Furthermore, the FBI has been informed and is presently investigating this matter. It emphatically highlights the increased risk that advanced threat actors will continue to weaponize vulnerabilities in VPNs and remote access. Companies have been urged to act quickly to prevent further breaches.

Sources: – CISA Emergency Directive – Ivanti Security Advisory