CVE-2024-11634 CRITICAL

CVE-2024-11634

Weakness CWE-77

Published December 10, 2024

Last update December 14, 2024

View on NVD All CVEs

CVSS base score

9.1/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality High

Integrity High

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

What the vulnerability does

01Description

Command injection in Ivanti Connect Secure before version 22.7R2.3 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution. (Not applicable to 9.1Rx)

Key dates

02Disclosure timeline

December 10, 2024 CVE published

December 14, 2024 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2024-11634 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/77.html

Related vulnerabilities

04Related CVE

CVE-2026-10127 Edimax BR-6478AC POST Request formStaDrvSetup command injection CVE-2026-45663 Dokploy: Remote Code Execution via destinationPath in Container File Upload CVE-2026-9361 Edimax EW-7438RPn POST Request formAccep formAccept command injection CVE-2026-42824 M365 Copilot Information Disclosure Vulnerability CVE-2026-12219 Yealink SIP-T46U Web FastCGI Service start mod_diagnose.CommandShellByType command injection