CVE-2024-37401: Ivanti Connect Secure DoS Vulnerability

CVE-2024-37401 Overview

CVE-2024-37401 is an out-of-bounds read vulnerability in the IPsec component of Ivanti Connect Secure and Ivanti Policy Secure appliances. This memory corruption flaw allows a remote unauthenticated attacker to trigger a denial of service condition by sending specially crafted network traffic to vulnerable systems. Given that Ivanti Connect Secure is widely deployed as a VPN solution for enterprise remote access, successful exploitation could disrupt critical business operations by denying legitimate users access to corporate resources.

Critical Impact

Remote unauthenticated attackers can cause denial of service on Ivanti VPN appliances, potentially disrupting enterprise remote access capabilities for entire organizations.

Affected Products

• Ivanti Connect Secure versions before 22.7R2.1
• Ivanti Policy Secure versions before 22.7R1.2
• Ivanti Connect Secure 22.7, 22.7R1, 22.7R1.1, 22.7R1.2, 22.7R1.3, 22.7R1.4, 22.7R1.5, 22.7R2

Discovery Timeline

• 2024-12-12 - CVE-2024-37401 published to NVD
• 2025-07-02 - Last updated in NVD database

Technical Details for CVE-2024-37401

Vulnerability Analysis

The vulnerability exists within the IPsec implementation of Ivanti Connect Secure and Policy Secure appliances. IPsec is a critical protocol suite used for securing Internet Protocol communications through authentication and encryption of each IP packet in a communication session. The out-of-bounds read condition (CWE-125) occurs when the IPsec component attempts to access memory beyond the allocated buffer boundaries during packet processing.

This type of memory corruption vulnerability is particularly dangerous in network-facing components because attackers can exploit it remotely without authentication. The impact is primarily availability-focused, as reading beyond buffer boundaries typically causes the affected process or system to crash, resulting in a denial of service condition.

Root Cause

The root cause is an out-of-bounds read (CWE-125) vulnerability in the IPsec packet processing logic. The IPsec component fails to properly validate input boundaries before reading data from memory buffers. When processing specially crafted IPsec packets, the vulnerable code reads past the end of the allocated buffer, leading to memory access violations that crash the service or appliance.

Attack Vector

The attack can be executed remotely over the network without requiring any authentication or user interaction. An attacker needs network access to the IPsec service port on the vulnerable Ivanti appliance. By sending malformed IPsec packets designed to trigger the out-of-bounds read condition, the attacker can cause the appliance to become unresponsive, denying access to legitimate VPN users.

The vulnerability is exploitable in the following scenario:

1. Attacker identifies an exposed Ivanti Connect Secure or Policy Secure appliance running a vulnerable version
2. Attacker sends specially crafted IPsec packets to the target appliance
3. The IPsec component processes the malformed packets and attempts to read beyond allocated buffer boundaries
4. The out-of-bounds read causes the service to crash, resulting in denial of service
5. Legitimate users lose VPN connectivity until the service is restored

Detection Methods for CVE-2024-37401

Indicators of Compromise

• Unexpected restarts or crashes of Ivanti Connect Secure or Policy Secure appliances
• Service availability disruptions affecting VPN connectivity for end users
• Unusual IPsec traffic patterns or malformed packet sequences in network logs
• System logs showing memory access violations or segmentation faults in IPsec-related processes

Detection Strategies

• Monitor Ivanti appliance uptime and service availability metrics for unexpected interruptions
• Implement network-based intrusion detection rules to identify anomalous IPsec traffic patterns
• Review system logs on Ivanti appliances for crash dumps or error messages related to IPsec processing
• Deploy network monitoring to detect repeated connection attempts following service disruptions

Monitoring Recommendations

• Enable comprehensive logging on Ivanti Connect Secure and Policy Secure appliances
• Configure alerting for appliance crashes, restarts, or service interruptions
• Monitor network traffic to IPsec ports for unusual packet characteristics or volume spikes
• Implement availability monitoring with rapid notification for VPN service outages

How to Mitigate CVE-2024-37401

Immediate Actions Required

• Upgrade Ivanti Connect Secure to version 22.7R2.1 or later immediately
• Upgrade Ivanti Policy Secure to version 22.7R1.2 or later immediately
• Review network access controls to limit exposure of IPsec services where possible
• Implement monitoring for service availability to detect exploitation attempts

Patch Information

Ivanti has released security updates to address this vulnerability. Administrators should upgrade to the following minimum versions:

• Ivanti Connect Secure: Version 22.7R2.1 or later
• Ivanti Policy Secure: Version 22.7R1.2 or later

For detailed patching instructions and download links, refer to the Ivanti December 2024 Security Advisory.

Workarounds

• Restrict network access to IPsec services using firewall rules to limit exposure to trusted IP ranges only
• Implement network segmentation to isolate Ivanti appliances from untrusted network segments
• Deploy web application firewalls or intrusion prevention systems with rules to detect malformed IPsec packets
• Consider temporarily disabling IPsec functionality if not required, pending patch deployment

# Example: Restrict IPsec access using iptables (adapt to your environment)
# Only allow IPsec traffic from trusted corporate networks
iptables -A INPUT -p udp --dport 500 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 4500 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p udp --dport 500 -j DROP
iptables -A INPUT -p udp --dport 4500 -j DROP