CVE-2023-46805

CVE-2023-46805 is a significant software vulnerability discovered in the web component of all supported versions of Ivanti Connect Secure and Ivanti Policy Secure (versions 9.x and 22.x). This flaw, which allows for authentication bypass, was first brought to the attention of the Cyber Centre on January 10, 2024, alongside another vulnerability, CVE-2024-21887, which enables command injection. Both vulnerabilities were found impacting Ivanti Connect Secure (ICS), formerly known as Pulse Connect Secure, and Ivanti Policy Secure (IPS) gateways. The MITRE Corporation reported that its systems were breached in January 2024 by a nation-state actor exploiting these two vulnerabilities. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) released an alert providing mitigations to defend against threat actors exploiting these vulnerabilities. On February 29, CISA issued another warning, emphasizing that threat actors were continuing to exploit multiple vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways, including CVE-2023-46805. Despite remaining reticent about the extent of the breach, CISA urged organizations to heed its advisory and protect their systems against these threats. The Five Eyes alliance also issued a warning about threat actors exploiting known security flaws in Ivanti Connect Secure and Ivanti Policy Secure gateways, including CVE-2023-46805. Software updates have been made available to address these vulnerabilities. Notably, Check Point IPS blade provides protection against these threats. It's crucial for organizations using Ivanti products to apply these updates promptly to protect their systems from potential breaches.