U.S. Cybersecurity Agency Warns of Actively Exploited Ivanti EPMM Vulnerability

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Thursday included a now-patched critical flaw impacting Ivanti Endpoint Manager Cellular (EPMM) and MobileIron Main to its Acknowledged Exploited Vulnerabilities (KEV) catalog, stating it’s currently being actively exploited in the wild.

The vulnerability in problem is CVE-2023-35082 (CVSS rating: 9.8), an authentication bypass that’s a patch bypass for yet another flaw in the exact same alternative tracked as CVE-2023-35078 (CVSS score: 10.).

“If exploited, this vulnerability enables an unauthorized, remote (internet-facing) actor to potentially entry users’ individually identifiable information and make constrained modifications to the server,” Ivanti famous in August 2023.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

All variations of Ivanti Endpoint Manager Mobile (EPMM) 11.10, 11.9 and 11.8, and MobileIron Core 11.7 and beneath are impacted by the vulnerability.

Cybersecurity company Rapid7, which found and described the flaw, explained it can be chained with CVE-2023-35081 to permit an attacker to compose malicious web shell documents to the equipment.

There are at this time no facts on how the vulnerability is becoming weaponized in authentic-environment attacks. Federal companies are encouraged to implement vendor-provided fixes by February 8, 2024.

The disclosure will come as two other zero-working day flaws in Ivanti Link Protected (ICS) virtual non-public network (VPN) units (CVE-2023-46805 and CVE-2024-21887) have also come underneath mass exploitation to drop web shells and passive backdoors, with the enterprise envisioned to launch updates subsequent week.

“We have observed the menace actor goal the configuration and jogging cache of the system, which is made up of strategies vital to the procedure of the VPN,” Ivanti claimed in an advisory.

“Whilst we haven’t noticed this in each and every instance, out of an abundance of caution, Ivanti is recommending you rotate these strategies following rebuild.”

Volexity, before this week, discovered that it has been able to obtain evidence of compromise of more than 1,700 products throughout the world. Whilst first exploitation was joined to a suspected Chinese menace actor named UTA0178, extra risk actors have considering the fact that joined the exploitation bandwagon.

More reverse engineering of the twin flaws by Assetnote has uncovered an further endpoint (“/api/v1/totp/person-backup-code”) by which the authentication bypass flaw (CVE-2023-46805) could be abused on more mature versions of ICS and receive a reverse shell.

Security researchers Shubham Shah and Dylan Pindur explained it as “one more instance of a secure VPN gadget exposing by itself to huge scale exploitation as the end result of fairly straightforward security mistakes.”

Observed this post interesting? Adhere to us on Twitter  and LinkedIn to read much more unique content material we submit.