Ivanti Releases Security Update for Multiple Products

Two vulnerabilities affect Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero-Trust Access (ZTA)

Threat ID:: CC-4193
Threat Severity:: Information only
Published:: 17 October 2022 4:36 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Two vulnerabilities affect Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero-Trust Access (ZTA)

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 22.2R4, all prior to 9.1R16.2, all prior to 9.1R15.2, all prior to 9.1R14.3 (LTS)

Ivanti Connect Secure

Versions: all prior to 22.3R1, all prior to 9.1R17

Ivanti Policy Secure

Versions: all prior to Neurons for Zero-Trust Gateway 22.3R1

Ivanti Neurons for Zero Trust Access

Ivanti Neurons for Secure Access

Threat details

Introduction

Ivanti has released a security update to address two vulnerabilities affecting Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Neurons for Zero-Trust Gateway. An attacker could exploit these vulnerabilities to cause a denial-of-service (DoS) condition and take control of an affected system.

Note: The Ivanti Neurons for Secure Access was affected by both vulnerabilities. Ivanti upgraded the hosted controller and completed the upgrade on October 09, 2022. There is no action to take regarding the Ivanti Neurons for Secure Access Controller.

Remediation advice

Affected organisations are encouraged to review Pulse security advisory SA45520 and apply the relevant update.

CVE Vulnerabilities

Status Reserved

CVE-2022-35254

Status Reserved

CVE-2022-35258

Last edited: 17 October 2022 4:36 pm