Ivanti has introduced security updates to handle a critical flaw impacting its Endpoint Supervisor (EPM) solution that, if productively exploited, could result in distant code execution (RCE) on vulnerable servers.
Tracked as CVE-2023-39336, the vulnerability has been rated 9.6 out of 10 on the CVSS scoring method. The shortcoming impacts EPM 2021 and EPM 2022 prior to SU5.
“If exploited, an attacker with accessibility to the inside network can leverage an unspecified SQL injection to execute arbitrary SQL queries and retrieve output devoid of the want for authentication,” Ivanti explained in an advisory.
Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.
Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).
➤ Activate Your Coupon Code
“This can then make it possible for the attacker control around machines operating the EPM agent. When the main server is configured to use SQL convey, this may possibly guide to RCE on the main server.”
The disclosure arrived months just after the enterprise settled just about two dozen security flaws in its Avalanche enterprise mobile unit administration (MDM) solution.
Of the 21 issues, 13 are rated critical (CVSS scores: 9.8) and have been characterised as unauthenticated buffer overflows. They have been patched in Avalanche 6.4.2.
“An attacker sending specifically crafted details packets to the Cellular Product Server can bring about memory corruption which could outcome in a denial-of-support (DoS) or code execution,” Ivanti mentioned.
While there is no evidence that these aforementioned weaknesses have been exploited in the wild, condition-backed actors have, in the previous, exploited zero-working day flaws (CVE-2023-35078 and CVE-2023-35081) in Ivanti Endpoint Supervisor Cellular (EPMM) to infiltrate the networks of multiple Norwegian federal government companies.
A month afterwards, one more critical vulnerability in the Ivanti Sentry product (CVE-2023-38035, CVSS rating: 9.8) came under energetic exploitation as a zero-day.
Found this short article fascinating? Abide by us on Twitter and LinkedIn to go through much more exclusive material we write-up.
Some areas of this write-up are sourced from:
thehackernews.com
Russian Hackers Had Covert Access to Ukraine’s Telecom Giant for Months