Ivanti · Virtual Traffic Manager
CVE-2024-7593
Ivanti Virtual Traffic Manager Authentication Bypass Vulnerability
공격에 악용됨
치명적 9.8 공격 가능성: >99.9%
무엇인가
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
CISA: Ivanti Virtual Traffic Manager contains an authentication bypass vulnerability that allows a remote, unauthenticated attacker to create a chosen administrator account.
할 일
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
미국 연방 기관 조치 기한: 2024년 10월 15일
Ivanti의 다른 악용된 결함
| 추가됨 | 취약점 | 제품 | 심각도 | 공격 가능성 |
|---|---|---|---|---|
| 2026. 10. 13. | Authentication Bypass by Spoofing | Connect Secure | 높음 8.6 | 87% |
| 2026. 6. 11. | OS Command Injection | Sentry | 치명적 10.0 | 99.9% |
| 2026. 5. 7. | Improper Input Validation | Endpoint Manager Mobile (EPMM) | 높음 7.2 | 34% |
| 2026. 4. 8. | Code Injection | Endpoint Manager Mobile (EPMM) | 치명적 9.8 | 99% |
| 2026. 3. 9. | Endpoint Manager (EPM) Authentication Bypass | Endpoint Manager (EPM) | 높음 8.6 | 88% |
| 2026. 1. 29. | Code Injection | Endpoint Manager Mobile (EPMM) | 치명적 9.8 | 99% |
| 2025. 5. 19. | Authentication Bypass | Endpoint Manager Mobile (EPMM) | 보통 5.3 | 99.9% |
| 2025. 5. 19. | Code Injection | Endpoint Manager Mobile (EPMM) | 높음 7.2 | 88% |
출처: Known Exploited Vulnerabilities(CISA, 퍼블릭 도메인), CVE records(cve.org), EPSS(FIRST). 공격 가능성은 누군가 향후 30일 안에 이 결함을 악용하려 할 확률에 대한 EPSS 추정치입니다.