Actively exploited · Published Dec 8, 2021 · Assigned by hackerone
CVE-2021-44529
Critical 9.8 Exploited Ransomware
In plain English
A critical-severity code injection in Ivanti EPM. Attackers are actively exploiting it in the wild (listed by CISA on March 25, 2024). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 99.1% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Apr 15, 2024.
Official description
A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | Ivanti EPM | 4.6.0-512 |
Weakness: CWE-94 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://forums.ivanti.com/s/article/SA-2021-12-02
- http://packetstormsecurity.com/files/166383/Ivanti-Endpoint-Manager-CSA-4.5-4.6-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/170590/Ivanti-Cloud-Services-Appliance-CSA-Command-Injection.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-44529 government-resource