Critical · 9.1 CVE-2024-47908 EUVD-2025-4980GHSA-jgrg-xx2q-5xgc

OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileg…

Published Feb 11, 2025 · Updated Feb 26, 2026 · Assigned by ivanti

Vendor: ivanti Product: Cloud Services Application Category: Network devices

Description

OS command injection in the admin web console of Ivanti CSA before version 5.0.5 allows a remote authenticated attacker with admin privileges to achieve remote code execution.

Affected products

Vendor	Product	Affected	Fixed
Ivanti	Cloud Services Application	—	5.0.5

Advisories 2

WID-SEC-2025-0315 Ivanti Cloud Services Appliance: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 11, 2025
WID-SEC-2024-3433 Ivanti Connect Secure: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 12, 2024

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CSA-CVE-2024-47908-CVE-2024-11771