CVE-2024-47907: Ivanti Connect Secure Buffer Overflow

CVE-2024-47907 Overview

CVE-2024-47907 is a stack-based buffer overflow vulnerability in the IPsec component of Ivanti Connect Secure. The flaw affects versions prior to 22.7R2.3 and allows a remote, unauthenticated attacker to trigger a denial of service condition on affected gateways. Because IPsec is exposed to untrusted networks by design, the attack surface includes any reachable VPN concentrator. The vulnerability is tracked under [CWE-121] (Stack-based Buffer Overflow) and [CWE-787] (Out-of-bounds Write). Ivanti published the issue in its November 2024 security advisory alongside multiple other CVEs affecting Connect Secure, Policy Secure, and Secure Access Client.

Critical Impact
A remote unauthenticated attacker can crash the IPsec service on Ivanti Connect Secure gateways, disrupting VPN availability for the enterprise.

Affected Products

Ivanti Connect Secure versions prior to 22.7R2.3
Ivanti Connect Secure 22.7 (including R1, R1.1–R1.5)
Ivanti Connect Secure 22.7R2, 22.7R2.1, and 22.7R2.2

Discovery Timeline

2024-11-12 - CVE-2024-47907 published to NVD
2024-11-18 - Last updated in NVD database

Technical Details for CVE-2024-47907

Vulnerability Analysis

The vulnerability resides in the IPsec implementation of Ivanti Connect Secure. IPsec (Internet Protocol Security) handles VPN tunnel negotiation and encrypted traffic for remote users. A stack-based buffer overflow occurs when the IPsec handler writes attacker-influenced data past the bounds of a fixed-size stack buffer. The overflow corrupts adjacent stack memory, including saved return addresses and frame pointers, which causes the IPsec process to terminate.

The attack requires no authentication and no user interaction. The impact is limited to availability — confidentiality and integrity are not affected based on the CVSS vector. Successful exploitation produces a denial of service against the VPN gateway, blocking legitimate remote access until the service recovers or is restarted.

Root Cause

The root cause is missing or insufficient bounds validation on data processed by the IPsec stack before it is copied into a fixed-size local buffer. When a crafted IPsec packet contains a field larger than the destination buffer, the copy operation writes beyond the allocated region. Ivanti has not published exploitation-level technical details. Refer to the Ivanti Security Advisory for vendor confirmation.

Attack Vector

The attack vector is network-based. An attacker sends malformed IPsec traffic to a vulnerable Connect Secure gateway over UDP ports 500 (IKE) or 4500 (NAT-Traversal). No credentials are required. The malformed packet triggers the stack overflow in the IPsec service, causing a crash. Because IPsec listens on the internet-facing interface by design, any reachable VPN endpoint is exposed.

No public proof-of-concept exploit is available at the time of writing. The EPSS score is 3.023% (86th percentile), reflecting moderate exploitation likelihood relative to other CVEs.

Detection Methods for CVE-2024-47907

Indicators of Compromise

Unexpected restarts or crashes of the IPsec service on Connect Secure appliances
Gaps in VPN session logs followed by IKE renegotiation storms from legitimate clients
Inbound UDP 500 or 4500 traffic from unusual source addresses preceding service disruption
Core dump or process termination entries referencing IPsec components in appliance logs

Detection Strategies

Monitor Ivanti Connect Secure system logs for repeated IPsec daemon restarts or segmentation faults
Inspect network telemetry for anomalous IKE/IPsec packet rates or malformed payloads directed at VPN gateways
Correlate VPN availability alerts with inbound UDP 500/4500 traffic patterns from non-customer IP ranges

Monitoring Recommendations

Forward Ivanti Connect Secure syslog data into a centralized SIEM and alert on IPsec service termination events
Track VPN tunnel establishment failure rates and trigger investigation on sudden spikes
Enable network IDS signatures for malformed IKEv1/IKEv2 packets targeting Ivanti gateways

How to Mitigate CVE-2024-47907

Immediate Actions Required

Upgrade Ivanti Connect Secure to version 22.7R2.3 or later as published in the November 2024 advisory
Inventory all Connect Secure appliances and verify firmware version against the fixed release
Restrict inbound IPsec traffic at perimeter firewalls to known client IP ranges where operationally feasible
Enable monitoring on VPN gateway availability to detect exploitation attempts early

Patch Information

Ivanti has released a fixed build in Connect Secure 22.7R2.3. Administrators should review the Ivanti Security Advisory for download instructions and verify the patched version after upgrade. The advisory bundles multiple CVEs, so apply the cumulative fix rather than addressing CVE-2024-47907 in isolation.

Workarounds

No vendor-supplied workaround exists — patching is the only complete remediation
Limit exposure by placing the VPN gateway behind network ACLs that restrict source IPs for IPsec traffic where possible
Maintain a tested failover or backup remote access path to preserve availability during exploitation attempts or patch windows

bash

# Verify Ivanti Connect Secure version after upgrade
show version
# Expected output should reflect 22.7R2.3 or later