In a concerning development, Ivanti, the Utah-based IT software company, has issued a warning about the active exploitation of a newly patched vulnerability in its Cloud Service Appliance (CSA). The vulnerability, tracked as CVE-2024-8190, carries a severity score of 7.2 on the CVSS scale and is classified as high-risk, enabling remote code execution under specific circumstances. The flaw primarily affects versions of the Ivanti Cloud Service Appliance that have reached end-of-life, compelling organizations to upgrade to newer, more secure versions to ensure continued protection.
The Nature of CVE-2024-8190: Command Injection Vulnerability
CVE-2024-8190 is a command injection vulnerability in Cloud Service Appliance versions 4.6 Patch 518 and earlier. The flaw allows an attacker with administrative privileges to execute arbitrary commands on the targeted system, leading to remote code execution. In an advisory released earlier this week, Ivanti highlighted the critical nature of this vulnerability, noting that attackers must be authenticated and have admin-level access to exploit it.
“An OS command injection vulnerability in Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution,” the company stated. While the flaw requires attackers to have administrative credentials, the potential damage is considerable. Once inside, a successful exploit could allow malicious actors to manipulate or control the system, exposing organizations to severe data breaches or infrastructure compromise.
Patch Released, End-of-Life Products Highlighted
The vulnerability has been addressed in Ivanti CSA version 4.6 Patch 519, which includes a fix for CVE-2024-8190. However, it has been made clear that CSA version 4.6 has reached its end-of-life status. This means that Patch 519 is the last update for this version, and customers are strongly urged to upgrade to the fully supported Ivanti CSA 5.0.
“With the end-of-life status, this is the last fix that Ivanti will backport for this version,” Ivanti warned. “Customers must upgrade to Ivanti CSA 5.0 for continued support.”
For users of Ivanti CSA 5.0, the good news is that this version does not contain the vulnerability in question. Ivanti has assured its customers that no further action is required for those already running CSA 5.0, as the security flaw is entirely absent from this version.
Active Exploitation in the Wild
On Friday, Ivanti updated its advisory, confirming that CVE-2024-8190 is actively being exploited in the wild. A “limited number of customers” have been targeted, although Ivanti has refrained from disclosing further details about the nature of these attacks or the identity of the threat actors responsible.
This revelation is significant given Ivanti’s history of vulnerabilities being leveraged by cyberespionage groups. In recent times, several zero-day vulnerabilities in Ivanti products have been exploited by nation-state actors, particularly groups linked to China. Although the specific details surrounding the exploitation of CVE-2024-8190 remain scarce, the broader context of nation-state attacks and cyberespionage elevates the risk posed by this flaw.
Government Response and Urgency of Action
In response to the active exploitation of this vulnerability, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2024-8190 to its Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog is an authoritative list of vulnerabilities that federal agencies are required to address to mitigate risk. CISA has set a deadline of October 4, 2024, for federal agencies to apply patches and ensure that the flaw is remediated in their environments.
The urgency with which CISA has reacted underscores the potential impact of this vulnerability on critical infrastructure and government systems. Given the active exploitation of the flaw, both public and private sector organizations are being urged to take immediate steps to mitigate the risk, either by applying the necessary patches or upgrading to Ivanti CSA 5.0.
Broader Security Landscape
As organizations work to patch CVE-2024-8190, a broader picture of vulnerabilities in Ivanti products continues to emerge. Around the same time as this disclosure, cybersecurity firm Horizon3.ai published a detailed technical analysis of a separate critical vulnerability in Ivanti’s Endpoint Manager (EPM). The flaw, identified as CVE-2024-29847, has a maximum CVSS score of 10.0 and is a deserialization vulnerability that can also lead to remote code execution. Given its critical severity, this vulnerability has the potential to cause widespread damage if left unpatched.
The emergence of multiple vulnerabilities across Ivanti’s product line reflects the growing complexity of the cybersecurity landscape. Attackers are increasingly targeting software with large user bases, knowing that critical flaws, if unpatched, provide entry points for various forms of cyberattacks, from ransomware to espionage. As a result, businesses and governmental agencies alike must remain vigilant and proactive in managing their security postures.
Conclusion
The active exploitation of CVE-2024-8190 serves as a stark reminder of the importance of timely patch management and security updates. With Ivanti Cloud Service Appliance 4.6 now at its end-of-life, customers who continue using older versions without upgrading risk being exposed to significant cyber threats. While Ivanti has provided patches for this vulnerability, the company’s strong recommendation to move to CSA 5.0 highlights the necessity of staying current with supported software versions.
As cyberattacks continue to evolve, vulnerabilities like CVE-2024-8190 present a clear and present danger, particularly when exploited by sophisticated threat actors. Organizations must act quickly to mitigate these risks, ensuring that they are not the next victim of a preventable cyber incident.
Follow us on 
(Twitter) for real time updates and exclusive content.
Interesting Article : GAZEploit: Apple Vision Pro Vulnerability Exposes Virtual Keyboard Inputs to Attackers