CVE-2024-10644 Overview
CVE-2024-10644 is a code injection vulnerability [CWE-94] affecting Ivanti Connect Secure before version 22.7R2.4 and Ivanti Policy Secure before version 22.7R1.3. A remote authenticated attacker with administrative privileges can exploit the flaw to achieve remote code execution on the affected appliance. Ivanti disclosed the issue as part of its February 2025 security advisory covering multiple CVEs across Connect Secure, Policy Secure, and Secure Access Client.
Critical Impact
Successful exploitation grants an authenticated administrator arbitrary command execution on the underlying appliance, compromising confidentiality, integrity, and availability of the VPN or network access control gateway.
Affected Products
- Ivanti Connect Secure versions prior to 22.7R2.4
- Ivanti Policy Secure versions prior to 22.7R1.3
- Ivanti Connect Secure 22.7 releases R1 through R2.3
Discovery Timeline
- 2025-02-11 - CVE-2024-10644 published to NVD as part of Ivanti's February 2025 security advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-10644
Vulnerability Analysis
The vulnerability is a code injection weakness categorized under [CWE-94]. An authenticated administrator can supply crafted input that the appliance incorporates into a code or command execution context without sufficient validation or sanitization. The result is arbitrary code execution in the security context of the Ivanti appliance process.
Ivanti Connect Secure and Policy Secure serve as network perimeter devices providing SSL VPN and network access control. Code execution on these devices places an attacker at a strategic pivot point for lateral movement into internal networks. The attack requires network access to the administrative interface and valid admin credentials, which limits the exploitation population but not the impact.
Root Cause
The root cause is improper neutralization of directives in dynamically generated code. Administrator-supplied input reaches a code interpretation or execution pathway without adequate escaping, allowing injected content to be executed as part of the program logic on the appliance.
Attack Vector
Exploitation requires network reachability to the administrative interface and authenticated access with administrative privileges. Attack complexity is low and no user interaction is required. Threat scenarios include credential compromise, insider misuse, and post-exploitation escalation following successful administrative credential theft. See the Ivanti February Security Advisory for the vendor description.
No public proof-of-concept exploit code is available at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-10644
Indicators of Compromise
- Unexpected administrative logins to the Connect Secure or Policy Secure management interface, particularly from unusual source addresses or outside change windows
- Unusual outbound network connections originating from the appliance to attacker-controlled infrastructure
- Anomalous processes, shell activity, or file modifications on the appliance not corresponding to vendor updates
- Newly created or modified administrator accounts, session tokens, or configuration changes without an approved ticket
Detection Strategies
- Correlate administrative interface authentication events with configuration changes to identify sequences consistent with post-authentication code injection
- Monitor the appliance's outbound traffic for connections to unfamiliar hosts, especially over non-standard ports
- Run Ivanti's Integrity Checker Tool (ICT) on Connect Secure and Policy Secure appliances to identify unauthorized file changes
Monitoring Recommendations
- Forward appliance syslog and admin audit logs to a centralized SIEM for long-term retention and correlation
- Alert on privileged configuration changes, package installations, or script executions performed through the admin UI or API
- Baseline normal administrator activity patterns and alert on deviations in source IP, time of day, or command frequency
How to Mitigate CVE-2024-10644
Immediate Actions Required
- Upgrade Ivanti Connect Secure to version 22.7R2.4 or later and Ivanti Policy Secure to version 22.7R1.3 or later
- Restrict administrative interface access to a limited set of trusted management IP addresses using network ACLs or firewall rules
- Rotate all administrator credentials and enforce multi-factor authentication for privileged accounts
- Review appliance configuration and audit logs for signs of unauthorized changes since the affected versions were deployed
Patch Information
Ivanti addressed the vulnerability in Connect Secure 22.7R2.4 and Policy Secure 22.7R1.3. Refer to the Ivanti February Security Advisory for the complete list of fixed versions and download instructions.
Workarounds
- Limit administrative interface exposure to management VLANs or jump hosts only, blocking direct internet exposure
- Enforce strong authentication and role separation to reduce the population of accounts capable of triggering the flaw
- Increase monitoring frequency on affected appliances until patching can be completed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
