Use of Hard-coded Cryptographic Key in Ivanti Policy Secure (formerly Pulse Policy Secure) and Ivanti Connect Secure (formerly Pulse Connect Secure) - CVE-2024-13842
Published: February 13, 2025
Vulnerability identifier: #VU103944
CSH Severity: Low
CVSS v4: 5.9 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N]
CVE-ID: CVE-2024-13842
CWE-ID: CWE-321
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to compromise the target system.
The vulnerability exists due to use of hard-coded cryptographic key. A local administrator can gain access to sensitive data.
Affected software
Ivanti Policy Secure (formerly Pulse Policy Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
Ivanti Connect Secure (formerly Pulse Connect Secure)
How to mitigate CVE-2024-13842
Install updates from vendor's website.
Ivanti Policy Secure (formerly Pulse Policy Secure) - update to 22.7R1.3
Ivanti Connect Secure (formerly Pulse Connect Secure) - update to 22.7R2.3
Ivanti Connect Secure (formerly Pulse Connect Secure) - update to 22.7R2.3