SB2025021311 - Use of Hard-coded Cryptographic Key in Ivanti Connect Secure (ICS) and Ivanti Policy Secure (IPS)

Description

This security bulletin contains information about 1 security vulnerability.

1) Use of Hard-coded Cryptographic Key (CVE-ID: CVE-2024-13842)

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to use of hard-coded cryptographic key. A local administrator can gain access to sensitive data.

Remediation

Install update from vendor's website.

References

• https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs