Unmasking the Threat: Urgent Advisory on Second Zero-Day Vulnerability in Ivanti EPMM

In today's rapidly evolving digital landscape, cybersecurity remains a paramount concern for organizations worldwide. In response to recent events, Ivanti, a leading IT software company, has acted swiftly by issuing an urgent warning to its customers regarding a second zero-day vulnerability discovered in its widely-used product, Endpoint Manager Mobile (EPMM). This critical flaw, already exploited in targeted attacks, has sent shockwaves through the cybersecurity community, emphasizing the significance of being vigilant and proactive in defending against potential threats. Safeguarding digital assets and protecting sensitive information are now critical imperatives for businesses.

A New Zero-Day Threat:
A zero-day vulnerability is a security flaw that is unknown to the software vendor, leaving no time for them to develop a patch before it gets exploited. On July 24, 2023, Norwegian authorities disclosed that numerous government ministries fell victim to a cyberattack involving the exploitation of the following vulnerabilities in Ivanti's EPMM:

• CVE-2023-35078: An authentication bypass vulnerability in Ivanti EPMM allows unauthorized users to access restricted functionality or resources of the application without proper authentication. This zero-day flaw enables an unauthenticated attacker to access sensitive information and manipulate impacted servers. CVSS 10 (Critical severity).
• CVE-2023-35081: Researchers from the cybersecurity firm Mnemonic discovered a high-severity flaw, allowing an authenticated attacker with administrator privileges to remotely write arbitrary files to the server. The CVSS score of 7.2 indicates the severity level as high.

The Dangers of Remote File Write Vulnerabilities:
Remote File Write (RFW) vulnerabilities pose grave risks to system security. Attackers can exploit these loopholes to create, modify, or delete files on a victim's system from a remote location, potentially leading to data breaches and complete system takeovers.

The Combined Exploitation:
To exacerbate the situation, threat actors have been observed leveraging the CVE-2023-35081 vulnerability in combination with CVE-2023-35078 to bypass admin authentication and access control list (ACL) restrictions. This technique enables them to execute malicious OS commands on the appliance as the tomcat user. The sophisticated nature of these attacks suggests a possible state-sponsored threat actor, although the exact identity of the attackers remains uncertain.

Taking Prompt Action with Armoryze:
Protecting your systems is of utmost importance. Armoryze offers a FREE consultation for our Risk-based Vulnerability Management Service, designed to help your organization fortify its cyber defenses. Don't wait until it's too late; schedule your consultation now, and our experts will assist you in safeguarding your digital assets.

The Urgent Need for Action:
If you are an Ivanti Endpoint Manager Mobile (EPMM) user, regardless of the version, you are at risk. The impacted versions include 11.4 releases 11.10, 11.9, and 11.8, as well as older releases. The severity of these vulnerabilities has led Ivanti and CISA to issue alerts, urgently advising organizations to apply patches immediately.

To safeguard your systems against the latest zero-day exploits, follow these steps:

1. Update your Ivanti EPMM software to the latest version available.
2. Apply all relevant patches provided by Ivanti as soon as possible.

As of now, the attackers behind these exploits remain unidentified, but the evidence suggests they may be state-sponsored threat actors. Given the large number of potentially vulnerable internet-exposed systems and the availability of proof-of-concept (PoC) code for CVE-2023-35078, the risk of further exploitation is significant.

Take the First Step Towards Security:
As a leading cybersecurity company, Armoryze is dedicated to safeguarding businesses from such threats. We understand the importance of risk-based vulnerability management and offer a comprehensive service tailored to your organization's needs. By scheduling a FREE consultation with our experts, you can take the first step towards securing your systems against the latest zero-day exploits.

Conclusion:
The discovery of the second zero-day vulnerability in Ivanti EPMM highlights the ever-evolving landscape of cybersecurity threats. Remaining vigilant and adopting proactive security measures is paramount for organizations. Armoryze is ready to assist you in protecting your digital assets. Don't wait for an attack to happen—act now and schedule a FREE consultation to strengthen your defenses against potential cyber threats.