What is the CVSS score of CVE-2024-37404?

CVE-2024-37404 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 67.3%.

Is there a public PoC exploit available for CVE-2024-37404?

Yes, a public proof-of-concept exploit is available for CVE-2024-37404. Prioritise patching immediately. EPSS: 67.3%.

Is there a patch available for CVE-2024-37404?

Yes, a patch is available for CVE-2024-37404. Update the affected software to the latest version immediately.

Connect Secure CVE-2024-37404

HIGH

2024-10-18 support@hackerone.com

RCE Ivanti Connect Secure Policy Secure

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

CVE Published

Oct 18, 2024 - 23:15 nvd

HIGH 8.8

DescriptionNVD

AnalysisAI

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

Technical ContextAI

Improper Input Validation in the admin portal of Ivanti Connect Secure before 22.7R2.1 and 9.1R18.9, or Ivanti Policy Secure before 22.7R1.1 allows a remote authenticated attacker to achieve remote code execution. Affected products include: Ivanti Connect Secure, Ivanti Policy Secure. Version information: before 22.7.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.

More in Connect Secure

View all

CVE-2024-21887 CRITICAL Emergency POC

9.1 Jan 12

Ivanti Connect Secure and Policy Secure contain an authenticated command injection in web components allowing administra

CVE-2023-46805 HIGH Act Now POC

8.2 Jan 12

Ivanti Connect Secure and Policy Secure contain an authentication bypass in the web component allowing unauthenticated a

CVE-2024-21893 HIGH Act Now POC

8.2 Jan 31

Ivanti Connect Secure and Policy Secure contain an SSRF vulnerability in the SAML component allowing unauthenticated acc

CVE-2025-0282 CRITICAL Emergency POC

9.0 Jan 08

Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated

CVE-2025-22457 CRITICAL Emergency POC

9.8 Apr 03

Remote code execution in Ivanti Connect Secure (before 22.7R2.6), Ivanti Policy Secure (before 22.7R1.4), and Ivanti ZTA

CVE-2021-22893 CRITICAL Emergency

10.0 Apr 23

Pulse Connect Secure 9.0R3/9.1R1 and higher is vulnerable to an authentication bypass vulnerability exposed by the Windo

CVE-2025-22467 CRITICAL Emergency

9.9 Feb 11

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6 allows a remote authenticated attacker to

CVE-2020-8260 HIGH Act Now POC

7.2 Oct 28

A vulnerability in the Pulse Connect Secure < 9.1R9 admin web interface could allow an authenticated attacker to perform

CVE-2019-11539 HIGH Act Now POC

7.2 Apr 26

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4, 8.3RX before 8.3R7.1, 8.2RX before 8.2R12.1, and 8.1R

CVE-2024-21894 CRITICAL Act Now POC

9.8 Apr 04

A heap overflow vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an

CVE-2019-11540 CRITICAL Act Now POC

9.8 Apr 26

In Pulse Secure Pulse Connect Secure version 9.0RX before 9.0R3.4 and 8.3RX before 8.3R7.1 and Pulse Policy Secure versi

CVE-2024-21888 HIGH This Week POC

8.8 Jan 31

A privilege escalation vulnerability in web component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x

Same technique RCE

View all

CVE-2021-44228 CRITICAL POC

10.0

CVE-2017-7269 CRITICAL POC

9.8

CVE-2022-47966 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2023-3519 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2024-37404 vulnerability details – vuln.today

Back

Connect Secure CVE-2024-37404

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

More in Connect Secure

Same technique RCE

Share

External POC / Exploit Code