Skip to content
CVE PROGRAM SOURCE RECORD7.5 High

CVE-2024-22052

A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
hackerone

Description

A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Ivanti Connect Secure

Default version status: unaffected

  • 22.1R6.2 to < 22.1R6.2affected
  • 22.2R4.2 to < 22.2R4.2affected
  • 22.3R1.2 to < 22.3R1.2affected
  • 22.4R1.2 to < 22.4R1.2affected
  • 22.4R2.4 to < 22.4R2.4affected
  • 22.5R1.3 to < 22.5R1.3affected
  • 22.5R2.4 to < 22.5R2.4affected
  • 22.6R2.3 to < 22.6R2.3affected
  • 9.1R14.6 to < 9.1R14.6affected
  • 9.1R15.4 to < 9.1R15.4affected
  • 9.1R16.4 to < 9.1R16.4affected
  • 9.1R17.4 to < 9.1R17.4affected
  • 9.1R18.5 to < 9.1R18.5affected

Ivanti Policy Secure

Default version status: unaffected

  • 22.4R1.2 to < 22.4R1.2affected
  • 22.5R1.3 to < 22.5R1.3affected
  • 22.6R1.2 to < 22.6R1.2affected
  • 9.1R16.4 to < 9.1R16.4affected
  • 9.1R17.4 to < 9.1R17.4affected
  • 9.1R18.5 to < 9.1R18.5affected

References