CVE-2024-7593

The flaw lies in the improper implementation of the authentication algorithm (CWE-303 – incorrect implementation of identity verification). An attacker can send a specially crafted network request that the system treats as properly authenticated, despite the lack of valid credentials. The vulnerability is remotely accessible over the network without requiring any user interaction or prior privileges (vector AV:N/AC:L/PR:N/UI:N).

An attacker gains full, unauthorized access to the Ivanti vTM administration panel, which may result in device takeover, modification of network traffic configuration, and compromise of system confidentiality, integrity, and availability.

Ivanti vTM must be immediately updated to version 22.2R1 or 22.7R2, which contain the vendor's security patch. Details are available in the official Ivanti security bulletin: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Virtual-Traffic-Manager-vTM-CVE-2024-7593

Ivanti Virtual Traffic Manager (vTM) in all versions other than 22.2R1 and 22.7R2.

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.