Ivanti Connect Secure Zero-Days (CVE-2023-46805, CVE-2024-21887).

Two chained zero-day vulnerabilities in Ivanti Connect Secure VPN appliances exploited by suspected Chinese espionage actors in late 2023 and early 2024. It belongs to the Vulnerabilities category of cybersecurity.

Two chained zero-day vulnerabilities in Ivanti Connect Secure VPN appliances exploited by suspected Chinese espionage actors in late 2023 and early 2024.

In January 2024, Ivanti and Mandiant disclosed two zero-day vulnerabilities in Ivanti Connect Secure and Policy Secure: CVE-2023-46805, an authentication bypass in the web component, and CVE-2024-21887, a command injection in administrative components. Chained together, they allow unauthenticated remote code execution on the appliance. Mandiant attributed initial exploitation to UNC5221, a suspected Chinese espionage cluster that deployed web shells and credential stealers. CISA and other agencies issued emergency directives ordering disconnection of affected appliances. Mitigation included applying staged patches, running the Integrity Checker Tool, factory resetting compromised devices and rotating all related credentials and certificates.

Defences for Ivanti Connect Secure Zero-Days (CVE-2023-46805, CVE-2024-21887) typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Ivanti Connect Secure RCE, CVE-2024-21887 chain.