CVE-2023-46805
Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability
Description
CVE-2023-46805 is a HIGH severity authentication bypass vulnerability affecting the web component of Ivanti Connect Secure (ICS) 9.x and 22.x, and Ivanti Policy Secure. With a CVSS 3.1 score of 8.2, the flaw allows remote unauthenticated attackers to access restricted resources by circumventing control checks — without requiring any credentials or user interaction. The vulnerability is classified under CWE-287 (Improper Authentication). This CVE is listed in CISA’s Known Exploited Vulnerabilities catalog, has been confirmed exploited in the wild, and is associated with ransomware activity. It is frequently exploited in conjunction with CVE-2024-21887, a companion command injection flaw, forming a powerful unauthenticated remote code execution chain.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:NOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | 9.0; 9.1; 22.1; 22.2; 22.3; 22.4; 22.5; 22.6 |
| ivanti | policy secure | 9.0; 9.1; 22.1; 22.2; 22.3; 22.4; 22.5; 22.6 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
References
- http://packetstormsecurity.com/files/176668/Ivanti-Connect-Secure-Unauthenticated-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- https://forums.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-46805(US Government Resource)
Weakness Type
CWE-287: Improper Authentication
CVE-2023-46805 is rooted in CWE-287 — Improper Authentication. The Ivanti Connect Secure and Policy Secure web components failed to correctly enforce authentication checks on certain URL paths or API endpoints. An attacker can bypass authentication by crafting requests that exploit this flawed logic, gaining access to resources that should require valid credentials.
Improper Authentication weaknesses are particularly dangerous in VPN and network access gateway products because these systems are specifically designed to control network perimeter access. A bypass in authentication fundamentally undermines the security guarantee of the entire product. When combined with a subsequent code execution vulnerability, the impact escalates to a full system compromise without requiring any legitimate credentials.
Impact Analysis
CVE-2023-46805 is rated HIGH with a CVSS 3.1 score of 8.2 and asymmetric impact across the three security dimensions.
Confidentiality (High): By bypassing authentication, an attacker gains unauthorized access to restricted resources and internal interfaces on the Ivanti gateway. This includes access to configuration data, network topology details, VPN session information, and potentially credentials stored on the appliance. In real-world attacks, threat actors have used this access to steal credentials and move laterally into victim networks.
Integrity (Low): The authentication bypass alone provides limited write access to the system. However, when chained with CVE-2024-21887 (command injection requiring authenticated admin access), the combined attack chain enables full write capability, arbitrary command execution, and complete system compromise.
Availability (None): The standalone authentication bypass does not directly cause service disruption. However, in chained exploitation scenarios, attackers have been observed deploying webshells and malware that can impact system availability.
With an EPSS score of 0.944 (99.96th percentile), exploitation of this vulnerability is near-certain and has been observed in mass exploitation campaigns targeting organizations globally.
Exploit Maturity
CVE-2023-46805 exhibits extremely high exploit maturity. The EPSS score of 0.944 places this vulnerability in the 99.96th percentile, reflecting active and widespread exploitation observed in the wild.
Active exploitation confirmed: CISA included this CVE in the Known Exploited Vulnerabilities catalog with a remediation due date of January 22, 2024. The vulnerability was being actively exploited by threat actors, including nation-state groups, in zero-day campaigns before patches were available.
Ransomware association: The KEV catalog confirms ransomware association for CVE-2023-46805. Ransomware operators and affiliated threat groups have leveraged this vulnerability as an initial access vector.
Chained exploitation: CVE-2023-46805 is most dangerous when combined with CVE-2024-21887. The authentication bypass provides the unauthenticated attacker with access to the admin web component, and CVE-2024-21887 then enables arbitrary command execution from that elevated context. Public exploit code demonstrating the combined chain has been released.
Mass exploitation: Multiple threat intelligence reports documented widespread scanning and exploitation of Ivanti gateways following disclosure, with thousands of devices compromised globally.
Remediation
- Apply Ivanti vendor patches immediately. Ivanti released mitigations and patches for CVE-2023-46805. Follow the guidance in the official Ivanti security advisory for Connect Secure and Policy Secure products.
- Apply the factory reset and re-deploy from a clean image. Given reports of persistent implants surviving normal updates, Ivanti and CISA recommended that compromised organizations perform a factory reset and re-image affected appliances to eliminate any attacker-deployed webshells or persistence mechanisms.
- Use the Ivanti Integrity Checker Tool (ICT). Run the Integrity Checker Tool provided by Ivanti to detect signs of compromise, unauthorized file modifications, or implanted backdoors on the appliance before and after patching.
- Revoke and rotate credentials. Assume all credentials accessible from or through the affected Ivanti gateway have been compromised. Rotate all passwords, certificates, API keys, and VPN credentials used with the device.
- Monitor for post-exploitation indicators. Review logs for unusual authentication activity, unexpected outbound connections, and signs of lateral movement from systems that communicated through the gateway.
- Discontinue use if patching is unavailable. Per CISA KEV guidance, discontinue use of the product if mitigations cannot be applied in a timely manner.
Technical Details
CVE-2023-46805 affects the web component of Ivanti Connect Secure (versions 9.x and 22.x) and Ivanti Policy Secure. These products are enterprise SSL VPN and network access control solutions used to provide secure remote access to corporate networks.
Authentication bypass mechanism: The vulnerability exists because certain URL paths or endpoints within the Ivanti web interface fail to enforce proper authentication checks. An attacker can craft specially formatted HTTP requests that reach restricted resources without presenting valid session credentials. The precise path traversal or URL manipulation technique bypasses the access control layer that should validate user identity.
Network exposure: With an attack vector of Network, no privileges required, and no user interaction needed (AV:N/AC:L/PR:N/UI:N), the vulnerability is exploitable by any internet-accessible attacker against any exposed Ivanti Connect Secure or Policy Secure appliance.
Chaining with CVE-2024-21887: This CVE is designed to be chained with CVE-2024-21887 (command injection in Ivanti web components). The authentication bypass grants unauthenticated access to the admin interface, while the command injection in CVE-2024-21887 provides arbitrary command execution when called from an authenticated context. Together, they enable unauthenticated remote code execution on the appliance.
Frequently Asked Questions
What is CVE-2023-46805?
CVE-2023-46805 is a HIGH severity authentication bypass vulnerability in the web component of Ivanti Connect Secure and Ivanti Policy Secure. It allows remote, unauthenticated attackers to access restricted resources by bypassing authentication control checks, exploiting a CWE-287 (Improper Authentication) weakness. It has been actively exploited in the wild.
Which products are affected by CVE-2023-46805?
The affected products are Ivanti Connect Secure (versions 9.x and 22.x) and Ivanti Policy Secure. Organizations using any of these Ivanti gateway versions that have not applied Ivanti’s security updates are vulnerable. The vulnerability affects the web-facing components of these VPN and network access control appliances.
How do I fix CVE-2023-46805?
Apply the patches and mitigations provided in Ivanti’s official security advisory. Due to confirmed active exploitation and the potential for persistent implants, Ivanti and CISA recommend performing a factory reset and re-imaging affected appliances rather than patching in place. Run the Ivanti Integrity Checker Tool to detect compromise, and rotate all credentials accessible through the gateway.
How severe is CVE-2023-46805?
CVE-2023-46805 carries a HIGH severity rating with a CVSS 3.1 score of 8.2. Its EPSS score of 0.944 places it in the 99.96th percentile, indicating near-certain exploitation activity. CISA confirmed active exploitation and ransomware association, requiring federal agencies to remediate by January 22, 2024. When chained with CVE-2024-21887, it enables fully unauthenticated remote code execution.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.