Security firm Ivanti says it has fixed a zero-day vulnerability in its Pulse Connect Secure (PCS) VPN appliance that was being actively exploited to compromise the internal networks of defense firms and government agencies.
A recent investigation carried out by the Cybersecurity and Infrastructure Security Agency (CISA) revealed that a zero-day vulnerability in PCS could have allowed cybercriminals to breach at least five US federal agencies.
According to cybersecurity firm FireEye, the vulnerability, tracked as CVE-2021-22893, enabled threat actors to deploy malware on PCS devices in order to steal credentials and provide backdoor access to any compromised network.
We’re looking at how our readers use VPN for a forthcoming in-depth report. We’d love to hear your thoughts in the survey below. It won’t take more than 60 seconds of your time.
FireEye has attributed the cyberattacks to hackers believed to be based in China.
Under constant threat
Ivanti responded by first releasing the Pulse Connect Secure Integrity Tool to enable users to check if hackers had modified any files on their Pulse Secure appliances.
They followed it up now by patching the vulnerability altogether with the help of CISA, FireEye and other cyber security experts.
“The Pulse team took swift action to provide mitigations directly to the limited number of impacted customers that remediates the risk to their system, and we are pleased to be able to deliver a security patch in such short order to address the vulnerability,” said Phil Richards, Chief Information Security Officer at Ivanti.
In light of the attack, Richards added that the company is making “significant investments” to enhance their overall cyber security posture, including a broader implementation of secure application development standards.
Via BleepingComputer
