Critical RCE vulnerability patched by Ivanti

A concept image of someone typing on a computer. A red flashing danger sign is above the keyboard and nymbers and symbols also in glowing red surround it.

(Image credit: Getty Images)

Ivanti has released a patch for a critical vulnerability affecting its Standalone Sentry product, designed to provide authenticated apps secure access to backend resources.

In a security advisory, the company said that the discovered vulnerability allows threat actors to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.

The flaw, discovered by Vincent Hutsebaut, Pierre Vivegnis, Jerome Nokin, Roberto Suggi Liverani and Antonin B. of NATO Cyber Security Centre, is tracked as CVE-2023-41724, and carries a severity score of 9.6 (critical).

Patch now, or suffer the consequences

It affects all supported versions 9.17.0, 9.18.0, and 9.19.0, as well as older versions. The patch is available via the standard download portal, Ivanti said, adding that it “strongly encourages” customers to act immediately and apply the patch without hesitation.

“We are not aware of any customers being exploited by this vulnerability at the time of disclosure,” Ivanti concluded.

So far, 2024 is proving to be a nightmare year for Ivanti. In early January, it discovered a remote code execution (RCE) vulnerability in its Endpoint Management Software (EPM). While it was investigating the issue, it discovered two more flaws in early February. Soon, news broke of mass exploitation by numerous threat actors, attacking organizations of all shapes and sizes - CISA included.

While there was no concrete evidence, some reports suggested that even ransomware operators could have targeted vulnerable Ivanti endpoints. Others are saying that multiple Chinese state-sponsored groups have been actively exploiting these flaws.

Ivanti Pulse Secure, one of the vulnerable products, was said to have used a decade-old Linux and outdated libraries.

"Pulse Secure runs an 11-year-old version of Linux which hasn't been supported since November 2020," researcher Eclypsium said at the time. Eclypsium discovered multiple libraries which, among themselves, are vulnerable to 973 flaws. Of those, 111 have publicly known exploits.

More from TechRadar Pro

Take a look at our guide to the best firewalls
Proton Pass adds passkey support for all users - even those who don't pay
These are the best endpoint protection services around

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.