Ivanti EPMM privilege escalation flaw exploit now available, CVE 2024-22026. | CybSec Wizard

Cyber Security Wizard

Wizardry for Cyber

Cyber Security Wizard

TLDR:

A PoC exploit for CVE-2024-22026, a privilege escalation bug affecting Ivanti EPMM, has been released.
The vulnerability allows attackers to create a backdoor account with root access.

Technical details about and a proof-of-concept (PoC) exploit for CVE-2024-22026, a privilege escalation bug affecting Ivanti EPMM, has been released by the vulnerability’s reporter. The vulnerability was discovered by Bryan Smith and affects Ivanti EPMM v12.0 and earlier. The exploit allows attackers to elevate their privileges by creating a new user account with root access. This backdoor account bypasses the intended restricted shell environment, leading to complete system compromise and potential network intrusion.

CVE-2024-22026, as well as two SQL injection flaws, have been fixed in Ivanti EPMM v12.1.0.0. To mitigate the risk of exploitation, admins are advised to upgrade their installations to the latest available version as soon as possible.

Post Views: 89

Adrian Johnson

Latest from Blog

Get the inside scoop on cybersecurity with Contrast CISO David Lindner

TLDR: SQL injection remains a problem that can be prevented with application detection and response. Implementing multi-factor authentication can help lower cybersecurity insurance costs. CISA’s role in election disinformation highlights the need

Stay ahead with the Cybersecurity Pulse Report: Black Hat 2024 Edition

Cybersecurity Pulse Report – Black Hat 2024 Edition Summary TLDR: This will be uploaded to wordpress and so you can start with a Cybersecurity Pulse Report – Black Hat 2024 Edition Key

Moody’s: Cyber insurance competition rises, prices fall

Moody’s Ratings: Cyber Insurance Competition Up, Prices Down TLDR: Cyber insurance market poised for growth due to increased demand. New players entering the market may decrease premiums. Article Summary The cyber insurance

Syxsense acquires Absolute to beat cyber vulnerabilities with strength

TLDR: Absolute Security has acquired Syxsense to enhance its cyber resilience platform. The acquisition will simplify patching and remediation issues through automation. Article Summary: Absolute Security has acquired Syxsense to improve its

Apache’s OFBiz gets new fix for RCE exploits

TLDR: Apache released a security update for OFBiz to patch vulnerabilities, including a bypass of patches for two exploited flaws. The bypass, tracked as CVE-2024-45195, allows unauthenticated remote attackers to execute code

Feds caution: Russia-linked CVE threats target essential infrastructure

TLDR: Threat groups linked to Russia’s military intelligence service are targeting critical infrastructure in various sectors. The attackers have defaced websites, scanned infrastructure, and leaked stolen data. Summary: Federal authorities in the

Allies blame Russian military for destructive cyber-attacks

TLDR: US and allies accuse Russian military of launching cyber-attacks targeting critical infrastructure for espionage and sabotage purposes. Unit 29155, a cyber group affiliated with the Russian military, is responsible for deploying

Brazil bans X, and Tom Alcock on cybersecurity talent hunt

TLDR: Key Points: Brazil banned X (Twitter) due to misinformation during the presidential election. Tom Alcock, founder of Code Red Partners, discussed the importance of cybersecurity talent recruitment beyond traditional methods. In

Palo Alto Networks acquires IBM’s QRadar Assets in SIEM victory

Article Summary TLDR: Palo Alto Networks has acquired IBM’s QRadar SaaS assets to enhance its cybersecurity capabilities. The integration of QRadar’s assets into Palo Alto Networks’ Cortex XSIAM platform will lead to

NIST CSF 20: Secure your cyber world with confidence framework

TLDR: NIST has released Version 2.0 of its Cybersecurity Framework (CSF) with an enhanced focus on Privileged Access Management (PAM) and Identity & Access Management (IAM). Key updates in NIST CSF 2.0