CVE-2024-37401: Ivanti Connect Secure DoS Vulnerability

CVE-2024-37401 Overview

CVE-2024-37401 is an out-of-bounds read vulnerability in the IPsec component of Ivanti Connect Secure and Ivanti Policy Secure appliances. This memory corruption flaw allows a remote unauthenticated attacker to trigger a denial of service condition by sending specially crafted network traffic to vulnerable systems. Given that Ivanti Connect Secure is widely deployed as a VPN solution for enterprise remote access, successful exploitation could disrupt critical business operations by denying legitimate users access to corporate resources.

Critical Impact
Remote unauthenticated attackers can cause denial of service on Ivanti VPN appliances, potentially disrupting enterprise remote access capabilities for entire organizations.

Affected Products

Ivanti Connect Secure versions before 22.7R2.1
Ivanti Policy Secure versions before 22.7R1.2
Ivanti Connect Secure 22.7, 22.7R1, 22.7R1.1, 22.7R1.2, 22.7R1.3, 22.7R1.4, 22.7R1.5, 22.7R2

Discovery Timeline

2024-12-12 - CVE-2024-37401 published to NVD
2025-07-02 - Last updated in NVD database

Technical Details for CVE-2024-37401

Vulnerability Analysis

The vulnerability exists within the IPsec implementation of Ivanti Connect Secure and Policy Secure appliances. IPsec is a critical protocol suite used for securing Internet Protocol communications through authentication and encryption of each IP packet in a communication session. The out-of-bounds read condition (CWE-125) occurs when the IPsec component attempts to access memory beyond the allocated buffer boundaries during packet processing.

This type of memory corruption vulnerability is particularly dangerous in network-facing components because attackers can exploit it remotely without authentication. The impact is primarily availability-focused, as reading beyond buffer boundaries typically causes the affected process or system to crash, resulting in a denial of service condition.

Root Cause

The root cause is an out-of-bounds read (CWE-125) vulnerability in the IPsec packet processing logic. The IPsec component fails to properly validate input boundaries before reading data from memory buffers. When processing specially crafted IPsec packets, the vulnerable code reads past the end of the allocated buffer, leading to memory access violations that crash the service or appliance.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker needs network access to the IPsec service port on the vulnerable Ivanti appliance. By sending malformed IPsec packets designed to trigger the out-of-bounds read condition, the attacker can cause the appliance to become unresponsive, denying access to legitimate VPN users.

The vulnerability is exploitable in the following scenario:

Attacker identifies an exposed Ivanti Connect Secure or Policy Secure appliance running a vulnerable version
Attacker sends specially crafted IPsec packets to the target appliance
The IPsec component processes the malformed packets and attempts to read beyond allocated buffer boundaries
The out-of-bounds read causes the service to crash, resulting in denial of service
Legitimate users lose VPN connectivity until the service is restored

Detection Methods for CVE-2024-37401

Indicators of Compromise

Unexpected restarts or crashes of Ivanti Connect Secure or Policy Secure appliances
Service availability disruptions affecting VPN connectivity for end users
Unusual IPsec traffic patterns or malformed packet sequences in network logs
System logs showing memory access violations or segmentation faults in IPsec-related processes

Detection Strategies

Monitor Ivanti appliance uptime and service availability metrics for unexpected interruptions
Implement network-based intrusion detection rules to identify anomalous IPsec traffic patterns
Review system logs on Ivanti appliances for crash dumps or error messages related to IPsec processing
Deploy network monitoring to detect repeated connection attempts following service disruptions

Monitoring Recommendations

Enable comprehensive logging on Ivanti Connect Secure and Policy Secure appliances
Configure alerting for appliance crashes, restarts, or service interruptions
Monitor network traffic to IPsec ports for unusual packet characteristics or volume spikes
Implement availability monitoring with rapid notification for VPN service outages

How to Mitigate CVE-2024-37401

Immediate Actions Required

Upgrade Ivanti Connect Secure to version 22.7R2.1 or later immediately
Upgrade Ivanti Policy Secure to version 22.7R1.2 or later immediately
Review network access controls to limit exposure of IPsec services where possible
Implement monitoring for service availability to detect exploitation attempts

Patch Information

Ivanti has released security updates to address this vulnerability. Administrators should upgrade to the following minimum versions:

Ivanti Connect Secure: Version 22.7R2.1 or later
Ivanti Policy Secure: Version 22.7R1.2 or later

For detailed patching instructions and download links, refer to the Ivanti December 2024 Security Advisory.

Workarounds

Restrict network access to IPsec services using firewall rules to limit exposure to trusted IP ranges only
Implement network segmentation to isolate Ivanti appliances from untrusted network segments
Deploy web application firewalls or intrusion prevention systems with rules to detect malformed IPsec packets
Consider temporarily disabling IPsec functionality if not required, pending patch deployment

bash

# Example: Restrict IPsec access using iptables (adapt to your environment)
# Only allow IPsec traffic from trusted corporate networks
iptables -A INPUT -p udp --dport 500 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j DROP
iptables -A INPUT -p udp --dport 4500 -j DROP