Actively exploited in the wild
Ivanti Cloud Services Appliance (CSA) OS Command Injection Vulnerability
Ivanti - Cloud Services Appliance (CSA) · Listed in the CISA KEV since 2024-10-09. This indicates confirmed attacks in production environments.
Required action: As Ivanti CSA 4.6.x has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line, or later, of supported solution.
CVE-2024-9380
HighCVSS 7.2KEVSummary
OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2. A remote authenticated attacker with admin privileges can obtain remote code execution.
Risk Assessment
An attacker with a compromised admin account can gain full control over the CSA appliance, posing a serious risk to the entire infrastructure managed through it.
Recommendation
Upgrade Ivanti CSA to version 5.0.2 or later, restrict admin console access to trusted networks, and enable MFA for administrative accounts.
Other vulnerabilities in Ivanti CSA
Original NVD description (English source)
An OS command injection vulnerability in the admin web console of Ivanti CSA before version 5.0.2 allows a remote authenticated attacker with admin privileges to obtain remote code execution.