What You Need to Know

Cybersecurity is constantly evolving, with new vulnerabilities and exploits emerging every day. The latest critical vulnerability affecting organizations across the globe comes from Ivanti’s Endpoint Manager (EPM), a widely used software platform for managing devices and ensuring network security. This new exploit could potentially open the door for attackers to gain unauthorized access to your network and sensitive data through remote code execution (RCE).

In this blog, we’ll break down the details of this dangerous new exploit, explain why it’s critical to address it immediately, and outline the steps your organization should take to protect itself.

The Nature of the Ivanti Endpoint Manager RCE Exploit

The vulnerability in question, identified as CVE-2024-29847 with a CVSS score of 10.0, is classified as critical. This exploit takes advantage of a weakness in the Ivanti agent portal by turning unsafe data into code without proper validation. In simpler terms, attackers can exploit this flaw to execute malicious code on the EPM’s core server using an unauthenticated user, effectively bypassing security controls and gaining full access to your network and systems.

Once an attacker has established remote code execution on the server, they can manipulate the system in a variety of ways — from stealing data to deploying malware or further infiltrating the network. This makes the exploit highly dangerous, particularly for businesses that rely heavily on Ivanti’s Endpoint Manager to secure their IT environments.

Why This Vulnerability Is So Dangerous

While Ivanti has stated that they are not currently aware of this vulnerability being actively exploited in the wild, the severity of the flaw and Ivanti’s widespread use make it a high-priority concern. Attackers are quick to take advantage of unpatched vulnerabilities, and given the nature of this exploit, it’s likely only a matter of time before cybercriminals begin leveraging it to target organizations that have not yet updated their systems.

Some of the key reasons why this vulnerability should be addressed immediately include:

1. Unauthenticated Access
One of the most alarming aspects of this exploit is that it does not require authentication to gain access to the system. This means that attackers don’t need valid credentials or user permissions to take control of the EPM server. Once they exploit the vulnerability, they can execute commands with full privileges, effectively allowing them to control the network.

2. Remote Code Execution (RCE)
The ability to remotely execute code makes this vulnerability extremely dangerous. Attackers can use the RCE flaw to deploy ransomware, steal sensitive data, disrupt operations, or even use the compromised system as a launch point for further attacks on other parts of the network.

3. Widespread Use of Ivanti EPM
Ivanti Endpoint Manager is widely used in various industries to manage devices, software, and security updates. With so many organizations relying on this software, the risk posed by the vulnerability is significant. A failure to address the issue could leave your organization vulnerable to major cyberattacks.

Affected Devices and Versions

The Ivanti Endpoint Manager RCE exploit affects the following versions of Ivanti EPM:

• Endpoint Manager (EPM) versions 2024 and 2022 SU5 and all previous versions.

If your organization is running any of these versions of Ivanti Endpoint Manager, it is crucial that you take immediate action to update your systems and secure your network.

Ivanti’s Response: Patch Now Available

In response to this critical vulnerability, Ivanti has released a patch to address the flaw. The patch not only fixes the vulnerability that allows for remote code execution but also addresses other potential security risks within the software. Organizations using Ivanti Endpoint Manager are advised to apply this update immediately to ensure that their systems are no longer at risk.

Immediate Action Required

If your organization is using Ivanti Endpoint Manager, here are the steps you need to take to protect your network from this exploit:

1. Update Affected Systems

The most important action you can take is to update your affected systems to the latest version of Ivanti Endpoint Manager. Ivanti has released the following updates:

• EPM version 2024 SU1
• EPM version 2022 SU6

These updates contain the necessary patches to fix the vulnerability and prevent attackers from exploiting it. Ensure that your IT team applies these updates as soon as possible.

2. Audit and Review Your Network

In addition to updating your systems, it’s critical to conduct a thorough audit of your network to check for potential exposure. Review your system logs for any suspicious activity that could indicate an attempt to exploit this vulnerability. Ensure that your security tools, such as firewalls and intrusion detection systems, are properly configured and capable of monitoring for signs of malicious activity.

3. Strengthen Your Security Posture

While updating your systems is a necessary first step, it’s also important to review and strengthen your overall security posture. Consider implementing additional layers of defense, such as multi-factor authentication (MFA), network segmentation, and regular security training for employees. These measures can help prevent future attacks, even if vulnerabilities are discovered in other parts of your network.

Quick Points to Remember

• Vulnerability ID: CVE-2024-29847 (CVSS score: 10.0)
• Severity: Critical
• Affected Devices: Endpoint Manager (EPM) versions 2024 and 2022 SU5, and all previous versions.
• Immediate Action:
  • Update affected systems to the latest version: EPM version 2024 SU1 or EPM version 2022 SU6.
  • Audit and review your network for signs of potential exposure.

Don’t Wait Until It’s Too Late

The Ivanti Endpoint Manager RCE exploit presents a significant risk to organizations using this software. While there is currently no evidence that this vulnerability has been exploited in the wild, its severity and the potential damage it could cause make it essential to take immediate action. By applying the patch, auditing your network, and reinforcing your security defenses, you can protect your organization from this dangerous exploit.

If you need assistance with patching your systems, auditing your network, or strengthening your cybersecurity measures, our team is here to help. CONTACT US TODAY to schedule a consultation and ensure that your organization is protected against this and other emerging threats.

What You Need to Know and How to Protect Your Network

In the ever-evolving cybersecurity landscape, new vulnerabilities emerge constantly, posing significant risks to organizations. The latest critical threat comes from Progress Software’s LoadMaster products, widely used as load-balancing solutions. A recently discovered vulnerability could allow remote, unauthenticated attackers to access your network and sensitive company data.

This vulnerability, identified as CVE-2024-7591 with a severity rating of 10.0 on the CVSS scale (the highest possible score), impacts multiple Progress devices, including the LoadMaster and LoadMaster Multi-Tenant (MT) Hypervisor. For businesses relying on these solutions, immediate action is necessary to mitigate potential risks and prevent unauthorized access to critical systems.

This blog will break down the details of this vulnerability, discuss who is affected, and outline the steps you need to take to protect your organization.

The Nature of the Vulnerability

The vulnerability in question arises from improper input validation within the affected Progress Software products. This flaw allows attackers to gain access to the LoadMaster’s management interface without authentication. Once access is granted, attackers can execute arbitrary system commands on the victim’s machine, compromising the security of the entire network.

This type of vulnerability is particularly dangerous as it provides attackers with a direct entry point into the network, bypassing traditional security controls. By gaining control of the LoadMaster’s management interface, an attacker could potentially intercept, manipulate, or even destroy sensitive data, significantly disrupting business operations.

Affected Products and Versions

This vulnerability affects a wide range of Progress Software products, particularly those used for load balancing. The specific devices and versions impacted are as follows:

• LoadMaster versions 7.2.60.0 and all previous versions
• MT Hypervisor versions 7.1.35.11 and all previous versions
• Long-Term Support (LTS) and Long-Term Support with Feature (LTSF) branches are also vulnerable.

If your organization is using any of these versions, you are at risk. Immediate action is required to patch and secure your systems.

Progress Software’s Response: A Patch Is Available

Progress Software has responded swiftly by releasing an add-on patch that addresses this vulnerability for most affected versions of LoadMaster and MT Hypervisor. This patch corrects the improper input validation flaw and strengthens the management interface against unauthorized access.

However, it’s important to note that this patch is not applicable to free versions of LoadMaster. If your organization is using the free version, the vulnerability remains unaddressed, and additional security measures should be implemented to protect your network.

Immediate Actions to Take

Given the severity of this vulnerability, there are several key steps you need to take to protect your organization from exploitation:

1. Apply the Patch Immediately: If you are using any of the affected versions of LoadMaster or MT Hypervisor, the first step is to apply the patch provided by Progress Software. The patch is available on their support portal, and you can follow the instructions provided in the forum post regarding LoadMaster Security Vulnerability CVE-2024-7591.
2. Harden Your Security Settings: In addition to applying the patch, Progress Software has outlined basic security hardening techniques that should be implemented to further protect your network. These measures include disabling unnecessary services, configuring firewalls to restrict access to the management interface, and enabling logging and monitoring to detect suspicious activity. For detailed steps on security hardening, refer to Progress’ post on LoadMaster Security Measures.
3. Monitor Your Network for Signs of Exploitation: Once the patch has been applied and security settings hardened, it’s crucial to monitor your network for any signs of exploitation. Use Intrusion Detection Systems (IDS) and Intrusion Prevention Systems (IPS) to keep a close watch on network traffic and identify any abnormal or malicious activity. Regularly reviewing logs and running vulnerability scans can help detect potential attacks before they cause significant damage.

Why This Vulnerability Should Be Taken Seriously

Cybercriminals are constantly scanning the internet for unpatched systems they can exploit, and vulnerabilities like CVE-2024-7591 present a prime opportunity for attackers to gain access to corporate networks. Once inside, attackers can cause significant damage, from data breaches and financial losses to operational disruption and reputational harm.

In this case, the ability for an attacker to bypass authentication and execute arbitrary commands means that even organizations with strong perimeter defenses are at risk. If left unpatched, this vulnerability could be used to steal sensitive data, disrupt business operations, or launch further attacks against your network.

Quick Points to Remember

• Vulnerability ID: CVE-2024-7591 (CVSS score: 10.0)
• Severity: Critical
• Affected Versions: LoadMaster versions 7.2.60.0 and all previous versions; MT Hypervisor versions 7.1.35.11 and all previous versions; Long-Term Support (LTS) and Long-Term Support with Feature (LTSF) branches are all impacted.
• Immediate Action: Apply the add-on patch available from Progress Software’s support portal and follow the recommended security hardening steps.

Don’t Wait Until It’s Too Late

In the world of cybersecurity, waiting to address a critical vulnerability can have devastating consequences. The Progress Software LoadMaster vulnerability presents a serious threat to organizations that rely on these products for load balancing. By taking immediate action to apply the patch and implement additional security measures, you can significantly reduce your risk of exploitation and ensure that your network remains secure.

If you need assistance with applying the patch, hardening your security settings, or monitoring your network for signs of an attack, our team is here to help. Don’t wait for an attack to happen—take the first step towards stronger security today. Contact us to schedule a consultation and learn how we can protect your network.

In the ongoing battle to keep networks secure from cyber threats, two highly critical vulnerabilities have been discovered in Cisco’s Smart Licensing Utility software. Cisco products, which are widely used by businesses and organizations across various sectors, rely heavily on this software to manage licenses across devices. The vulnerabilities in question—CVE-2024-20439 and CVE-2024-20440—pose a significant risk as they could allow unauthorized, remote attackers to gain complete access to an organization’s network. This access opens the door to potentially catastrophic consequences, including the theft of sensitive data, unauthorized control over key network components, and a greater exposure to further exploits.

In this blog, we’ll walk you through what these vulnerabilities mean, how they could impact your organization, and what immediate actions you need to take to protect your systems.

The Nature of the Vulnerabilities: CVE-2024-20439 and CVE-2024-20440

Cisco disclosed that these vulnerabilities revolve around the exploitation of an undocumented administrative account embedded within the Smart Licensing Utility software. This default account can be used by attackers to gain unauthorized access to an affected system. What makes this vulnerability especially dangerous is that it doesn’t require any authentication to exploit. In simple terms, attackers could exploit these vulnerabilities remotely without having any credentials, bypassing typical security mechanisms.

Once an attacker gains access to the system via these vulnerabilities, they can execute arbitrary commands and elevate their privileges to take full control of the device. The risk of complete system compromise becomes even more apparent given the wide range of Cisco products that utilize the Smart Licensing Utility. These products include routers, switches, Next-Gen Firewalls (NGFW), wireless controllers, and Cisco DNA Center.

The Scope of the Threat: Why This Matters

Cisco is a global leader in networking hardware, and its products are integral to countless organizations’ IT infrastructure. The Smart Licensing Utility is a critical feature embedded across many of these devices, meaning the potential attack surface is vast. The two vulnerabilities, both assigned a CVSS score of 9.8, reflect the critical nature of the threat.

The use of the Smart Licensing Utility in various Cisco products makes this vulnerability particularly widespread and dangerous. For example:

• Routers and Switches: Devices that form the backbone of networks, handling data transfers between multiple devices and systems.
• Next-Gen Firewall (NGFW) Solutions: Critical for protecting networks against sophisticated threats.
• Wireless Controllers: Managing network access points for wireless connectivity.
• Cisco DNA Center: A centralized management and automation platform for network infrastructure.

If exploited, attackers can infiltrate an organization’s network, potentially gaining control over its most critical assets. Whether it’s the manipulation of network traffic, stealing sensitive data, or further escalating the attack to other systems, the damage could be irreversible.

Immediate Actions You Should Take

Given the severity of these vulnerabilities and the potential impact they could have on your network, it’s vital that you take swift and decisive action. Cisco has already released patches to address these vulnerabilities, and applying these updates is the most critical step toward securing your systems.

Here’s what you need to do:

1. Update Affected Systems Immediately:

   • Cisco has released the necessary patches for all affected systems, with the latest version being Cisco Smart Licensing Utility version 2.3.0. This update addresses the vulnerabilities and eliminates the threat posed by the undocumented administrative account.
   • Ensure that all affected versions—2.0.0, 2.1.0, and 2.2.0—are updated immediately to version 2.3.0 or later.

2. Audit and Update All Cisco Devices:

   • Given that Smart Licensing Utility is used across multiple Cisco products, it’s essential to conduct a thorough audit of all devices in your network that may be using this software. This includes routers, switches, firewalls, wireless controllers, and Cisco DNA Center devices.
   • Ensure that these devices are running the latest firmware and that all patches recommended by Cisco are applied without delay.

3. Review Potential Exposure:

   • If your systems have been running affected versions of the Smart Licensing Utility for any length of time, it’s essential to conduct a review of any potential exposure to these vulnerabilities. Look for signs of unauthorized access or unusual activity, particularly around devices that utilize this software.
   • Implement real-time monitoring tools to help detect any suspicious activity moving forward.

4. Strengthen Your Network’s Security Posture:

   • Beyond applying the necessary patches, now is a good time to evaluate your overall security posture. Ensure that you’re utilizing best practices for network security, such as multi-factor authentication (MFA) for administrative accounts, robust encryption protocols, and continuous monitoring of network traffic.
   • Consider conducting a broader security audit to identify and address any other potential weaknesses in your infrastructure.

The Bigger Picture: Cybersecurity Requires Vigilance

The discovery of vulnerabilities like CVE-2024-20439 and CVE-2024-20440 serves as a reminder that even trusted technology solutions can have flaws that pose significant security risks. In a world where cyber threats are becoming more sophisticated, the need for constant vigilance has never been more apparent. The consequences of not addressing vulnerabilities in a timely manner can be disastrous, ranging from data breaches to operational disruptions and severe reputational damage.

Cybercriminals are always on the lookout for opportunities to exploit vulnerabilities, especially those that can provide them with elevated privileges and full network access. In this case, the presence of a default, undocumented administrative account is a glaring weakness that attackers are sure to take advantage of. The fact that this vulnerability can be exploited remotely and without any authentication only amplifies the urgency of the situation.

Cisco’s Response: A Call for Immediate Action

Cisco has acted swiftly in releasing patches to address these vulnerabilities, but it’s up to businesses and organizations to take immediate action to protect their systems. The company has issued an advisory urging teams to update affected devices and audit their networks for any signs of compromise.

At the end of the day, cybersecurity is a shared responsibility. By taking prompt action to address these vulnerabilities, you can help safeguard your business from potential threats and ensure that your network remains secure.

Stay Ahead of the Threat

The critical vulnerabilities discovered in Cisco’s Smart Licensing Utility software are a stark reminder of the evolving nature of cybersecurity threats. By staying informed, taking immediate action, and partnering with trusted IT professionals, you can mitigate the risks and protect your organization from potentially devastating attacks.

Take action now to secure your network—apply the necessary patches, audit your systems, and ensure that your Cisco devices are up to date with the latest security measures. If you need assistance with the update process or have questions about securing your systems, don’t hesitate to contact our team of cybersecurity experts. We are dedicated to your security and ready to help you navigate these challenges.