CVE-2024-22053

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack or in certain conditions read contents from memory.

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Weakness enumeration

CWE-787 CWE-703

Affected software

Vendor	Product	Versions
Ivanti	Connect Secure	>= 22.1R6.2, < 22.1R6.2; >= 22.2R4.2, < 22.2R4.2; >= 22.3R1.2, < 22.3R1.2; >= 22.4R1.2, < 22.4R1.2; >= 22.4R2.4, < 22.4R2.4; >= 22.5R1.3, < 22.5R1.3; >= 22.5R2.4, < 22.5R2.4; >= 22.6R2.3, < 22.6R2.3; >= 9.1R14.6, < 9.1R14.6; >= 9.1R15.4, < 9.1R15.4; >= 9.1R16.4, < 9.1R16.4; >= 9.1R17.4, < 9.1R17.4; >= 9.1R18.5, < 9.1R18.5
Ivanti	Policy Secure	>= 22.4R1.2, < 22.4R1.2; >= 22.5R1.3, < 22.5R1.3; >= 22.6R1.2, < 22.6R1.2; >= 9.1R16.4, < 9.1R16.4; >= 9.1R17.4, < 9.1R17.4; >= 9.1R18.5, < 9.1R18.5
ivanti	connect_secure	9.1R18.5; 22.6R2.3; 9.1R17.4; 22.2R3; 22.5R2.4; 9.1R14.6; 9.1R15.4; 22.2R4.2; 22.4R1.2; 22.6R1.2; 22.1R6.2; 22.3R1.2; 22.4R2.4; 22.5R1.3
ivanti	policy_secure	22.5R1.3; 9.1R18.5; 9.1R17.4; 22.2R3
ivanti	connect_secure	9.1R18.5; 22.6R2.3; 9.1R17.4; 22.2R3; 22.5R2.4; 9.1R14.6; 9.1R15.4; 22.2R4.2; 22.4R1.2; 22.6R1.2; 22.1R6.2; 22.3R1.2; 22.4R2.4; 22.5R1.3
ivanti	policy_secure	22.4R1.2; 22.5R1.3; 22.6R1.2; 9.1R16.4; 9.1R17.4; 9.1R18.5

References

Timeline

Published: Apr 4, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-220547.5A malformed discovery packet sent by a malicious actor with preexisting access to the network could interrupt the functionality of device ma CVE-2024-220587.8A buffer overflow allows a low privilege user on the local machine that has the EPM Agent installed to execute arbitrary code with elevated CVE-2024-220598.8A SQL injection vulnerability in web component of Ivanti Neurons for ITSM allows a remote authenticated user to read/modify/delete informati CVE-2024-22066.5An SSRF vulnerability exists in the gradio-app/gradio due to insufficient validation of user-supplied URLs in the `/proxy` route. Attackers CVE-2024-220604.9An unrestricted file upload vulnerability in web component of Ivanti Neurons for ITSM allows a remote, authenticated, high privileged user t CVE-2024-220619.8A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to ex CVE-2024-220628.8There is a permissions and access control vulnerability in ZXCLOUD IRAI.An attacker can elevate non-administrator permissions to administrat CVE-2024-220639.0The ZENIC ONE R58 products by ZTE Corporation have a command injection vulnerability. An authenticated attacker can exploit this vulnerabili CVE-2024-220646.5ZTE ZXUN-ePDG product, which serves as the network node of the VoWifi system, under by default configuration, uses a set of non-unique crypt CVE-2024-220658.8There is a command injection vulnerability in ZTE MF258 Pro product. Due to insufficient validation of Ping Diagnosis interface parameter, a CVE-2024-220666.5There is a privilege escalation vulnerability in ZTE ZXR10 ZSR V2 intelligent multi service router . An authenticated attacker could use the CVE-2024-220678.8ZTE NH8091 product has an improper permission control vulnerability. Due to improper permission control of the Web module interface, an auth