CVE-2024-21887

CriticalCVSS 9.1/10Known exploited (CISA KEV)Last modified Aug 4, 2026

Description

A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-77

Affected software

No affected versions have been published.

Timeline

Published: Jan 12, 2024
Last modified: Aug 4, 2026
Added to CISA KEV: Jan 10, 2024
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-218888.8A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows a use CVE-2024-21896.1The Social Icons Widget & Block by WPZOOM WordPress plugin before 4.2.18 does not sanitise and escape some of its Widget settings, which cou CVE-2024-218906.5The Node.js Permission Model does not clarify in the documentation that wildcards should be only used as the last character of a file path. CVE-2024-218918.8Node.js depends on multiple built-in utility functions to normalize paths provided to node:fs functions, which can be overwitten with user-d CVE-2024-218927.8On Linux, Node.js ignores certain environment variables if those may have been set by an unprivileged user while the process is running with CVE-2024-218938.2A server-side request forgery vulnerability in the SAML component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) CVE-2024-218949.8A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated mal CVE-2024-218969.8The permission model protects itself against path traversal attacks by calling path.resolve() on any paths given by the user. If the path is CVE-2024-218975.4A cross-site scripting (XSS) vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerabili CVE-2024-218988.8An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability co CVE-2024-218999.8An improper authentication vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability CVE-2024-219006.5An injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow a