Description
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Ivanti | vTM | — | 22.7R2 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Ivanti Virtual Traffic Manager Authentication Bypass (CVE-2024-7593)
auxiliary/admin/http/ivanti_vtm_admin
GitHub 3 repositories
-
D3N14LD15K/CVE-2024-7593_PoC_Exploit ★ 9 · Sep 24, 2024
CVE-2024-7593 Ivanti Virtual Traffic Manager 22.2R1 / 22.7R2 Admin Panel Authentication Bypass PoC [EXPLOIT]
-
aerchy/CVE-2024-7593 ★ 0 · Oct 12, 2024
-
rxerium/CVE-2024-7593 ★ 0 · Aug 28, 2024
Incorrect implementation of an authentication algorithm in Ivanti vTM other than versions 22.2R1 or 22.7R2 allows a remote unauthenticated attacker to bypass authentication of the admin panel.
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ivanti vTM - Authentication Bypass http/cves/2024/CVE-2024-7593.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Advisories 1
- NCSC-2024-0340 Kwetsbaarheid verholpen in Ivanti Virtual Traffic Manager NCSC-NL (Netherlands) · Sep 3, 2024