CVE-2024-22052

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 3.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-04-04 · updated 2026-06-17
Weakness: CWE-476

Description

A null pointer dereference vulnerability in IPSec component of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure allows an unauthenticated malicious user to send specially crafted requests in-order-to crash the service thereby causing a DoS attack

Affected products

Ivanti Connect Secure (Pulse Secure): 9.1-r1, 9.1-r10, 9.1-r11, 9.1-r11.5, 9.1-r12, 9.1-r13 (+22)
Ivanti Policy Secure: 9.0, 9.0-r1, 9.0-r2, 9.0-r2.1, 9.0-r3, 9.0-r3.1 (+26)

References

https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US
https://forums.ivanti.com/s/article/New-CVE-2024-21894-Heap-Overflow-CVE-2024-22052-Null-Pointer-Dereference-CVE-2024-22053-Heap-Overflow-and-CVE-2024-22023-XML-entity-expansion-or-XXE-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US

Get alerted when CVE-2024-22052 or the next vulnerability affects your stack