Ivanti: VPN appliances vulnerable if pushing configs after mitigation

Ivanti warned admins to stop pushing new device configurations to appliances after applying mitigations because this will leave them vulnerable to ongoing attacks exploiting two zero-day vulnerabilities. While the company didn't provide additional details, it said that this is caused by a known race condition when pushing configurations that causes a web service to stop and the applied mitigation to stop working. "Customers should stop pushing configurations to appliances with the XML in place, and not resume pushing configurations until the appliance is patched," Ivanti said in a new update published on Saturday. "When the configuration is pushed to the appliance, it stops some key web services from functioning, and stops the mitigation from functioning. This only applies to customers who push configurations to appliances, including configuration pushes through Pulse One or nSA. This can occur regardless of a full or partial configuration push." Ivanti company has yet to share if re-applying the mitigations XML also causes the mitigations to stop working, although this seems likely given that the race condition occurs each time new configurations are pushed to an appliance. The warning comes after CISA issued 2024's first emergency directive ordering U.S. agencies to immediately apply mitigations for two Ivanti Connect Secure and Policy Secure zero-day flaws exploited in widespread attacks by multiple threat actors. Ivanti ICS and IPS appliances have been targeted in large-...