CVE-2024-21887 (Ivanti Connect Secure and Policy Secure Command Injection)

What this vulnerability means in Ivanti appliances

Command injection in a VPN or remote-access appliance matters because the attacker is not just probing an application feature, they are trying to make the device execute operating-system commands with the appliance’s trust and reach. On Ivanti Connect Secure and Policy Secure, that can turn a perimeter system into an execution point inside the network.

The danger is amplified when a flaw is usable with another weakness in the same attack path. In this case, the primary definition already notes that CVE-2024-21887 can be leveraged with CVE-2023-46805, which is the kind of chaining defenders should expect when a single product exposes both authentication and command-execution weaknesses.

Why perimeter appliance compromise is so disruptive

Edge appliances sit at a high-value boundary: they broker remote access, terminate sessions, and often hold configuration, logs, certificates, or other sensitive operational material. If an attacker can execute commands on that device, they may be able to inspect traffic, tamper with configuration, create persistence, or pivot toward internal systems that were never meant to be directly exposed.

That is why the same family of incidents often leads to credential theft, session theft, or secondary compromise rather than a single isolated exploit. For a broader account of how Ivanti exploitation has been used to steal credentials and certificates on appliances, see Ivanti Connect Secure exploitation 2024.

Remote-access exposure also belongs in the wider defensive picture. Remote Access Identity Guide explains why VPN and edge access paths need continuous attention, especially where dormant accounts, third-party access, or weak entry-point controls still exist.

How organisations assess exposure and verify compromise

Exposure checks start with a complete inventory of appliances, versions, and internet-facing management paths, then move to vendor advisories and CISA KEV status so the organisation can decide which instances are most urgently at risk. If the appliance is externally reachable, the practical question is not only whether it is installed, but whether it is still exposed in a way that an attacker can reach.

When a flaw is already known to be exploited, prioritisation should be driven by asset criticality, exposure, and evidence of abuse rather than by generic patch queues. Vulnerability Management Guide is the best match for the asset scope, KEV prioritisation, verification, and exception handling process that turns a CVE from an abstract record into an operational decision.

Detection after suspected exploitation should include review of appliance logs, unusual admin activity, unexpected configuration changes, and signs that the device spawned shells or ran child processes. If compromise is plausible, treat credentials, sessions, API keys, certificates, and other appliance-held secrets as exposed until proven otherwise.

Remediation priorities when the device cannot be patched immediately

When an appliance patch cannot be applied right away, the immediate goal is to reduce reachable attack surface and stop further command-execution opportunities. That usually means restricting management access, tightening network paths to the device, and applying any vendor-recommended mitigations exactly as published rather than improvising controls that have not been validated.

Where the appliance may have been compromised, remediation is not limited to software replacement. Organisations should assume that the device may have been used to harvest credentials or establish persistence, then rotate any secrets, sessions, certificates, or dependent service credentials that the appliance could have accessed. For context on why secret exposure on edge devices often becomes the real incident, the Ivanti exploitation case study above is a useful reference point.

Post-patch review and containment follow-through

Even after patching, defenders should review whether the device was already used as an initial access point before the fix was applied. A successful attacker may have left behind new accounts, altered configs, modified tunnels, changed certificates, or scheduled commands that survive the original vulnerability window.

This is why post-patch work should include both forensic review and trust restoration. If the investigation cannot establish a clean boundary, the safer assumption is that the appliance was part of the intrusion path and should be treated as a recovery problem, not only a maintenance problem.

Risk and Threat Considerations

Command injection on a remote-access appliance creates high-impact risk because the exploit target is already positioned at a trust boundary. A successful attacker can use that execution point to steal secrets, alter access paths, or move from the edge into internal systems that were supposed to be insulated from direct exposure.

Failure mechanism: The attacker reaches a vulnerable input path, injects operating-system commands, and uses the appliance’s privileges and network position to perform follow-on actions such as credential theft, persistence, or lateral movement.

Impact: The result can include remote code execution on the appliance, compromise of remote access trust, exposure of sessions or certificates, and broader internal network compromise if the device is used as a pivot.

Practitioner Guidance

Why practitioners should care: Treat this CVE as a perimeter-control issue, not a narrow bug fix. The decision point is whether the appliance can still be reached in a way that lets an attacker turn a single injection into durable access or internal movement.

What to watch for: Focus on internet exposure, unexpected admin changes, unusual appliance child processes, and any sign that credentials or sessions were used elsewhere after the suspected exploit window.

Practitioner takeaway: For KEV-listed edge-device CVEs, patching is necessary but not sufficient, because the real work is proving the appliance was not already turned into an access foothold.

Related resources from NHI Mgmt Group

• CVE-2024-21893 (Ivanti Connect Secure, Policy Secure, and Neurons Server-Side Request Forgery (SSRF))
• CVE-2025-22457 (Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow)
• CVE-2025-0282 (Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow)
• CVE-2024-9380 (Ivanti Cloud Services Appliance (CSA) OS Command Injection)