{"schema":"vulnpedia.poc/1","cve":"CVE-2024-21887","generated":"2026-10-26T06:59:15.268Z","kev":{"since":"2024-01-10","ransomware":true},"epss":{"score":0.99999,"percentile":0.99999},"cvss":{"version":"3.1","score":9.1,"severity":"CRITICAL","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"},"has_public_poc":true,"poc_sources":[{"kind":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb","executable":true,"sourceId":"exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805","description":"Ivanti Connect Secure Unauthenticated Remote Code Execution","verification":"catalogued","source":"metasploit","modified":"2026-04-22 11:54:55 +0000","origins":[{"source":"metasploit","sourceId":"exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb"},{"source":"metasploit","sourceId":"exploit/linux/http/ivanti_connect_secure_rce_cve_2023_46805","modified":"2026-04-22 11:54:55 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2023_46805.rb"}]},{"kind":"metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb","executable":true,"sourceId":"exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893","description":"Ivanti Connect Secure Unauthenticated Remote Code Execution","verification":"catalogued","source":"metasploit","modified":"2026-04-22 11:54:55 +0000","origins":[{"source":"metasploit","sourceId":"exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb"},{"source":"metasploit","sourceId":"exploit/linux/http/ivanti_connect_secure_rce_cve_2024_21893","modified":"2026-04-22 11:54:55 +0000","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/ivanti_connect_secure_rce_cve_2024_21893.rb"}]},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/ecf3cf71be36","executable":false,"sourceId":"ecf3cf71be36","verification":"catalogued","source":"vulncheck-kev","modified":"2024-01-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"ecf3cf71be36","modified":"2024-01-10T00:00:00Z","url":"https://vulncheck.com/xdb/ecf3cf71be36"}],"repositoryUrl":"https://github.com/Chocapikk/CVE-2024-21887"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/a227bd0afc26","executable":false,"sourceId":"a227bd0afc26","verification":"catalogued","source":"vulncheck-kev","modified":"2024-01-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a227bd0afc26","modified":"2024-01-10T00:00:00Z","url":"https://vulncheck.com/xdb/a227bd0afc26"}],"repositoryUrl":"https://github.com/seajaysec/Ivanti-Connect-Around-Scan"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/983f05b4d88d","executable":false,"sourceId":"983f05b4d88d","verification":"catalogued","source":"vulncheck-kev","modified":"2024-01-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"983f05b4d88d","modified":"2024-01-10T00:00:00Z","url":"https://vulncheck.com/xdb/983f05b4d88d"}],"repositoryUrl":"https://github.com/oways/ivanti-CVE-2024-21887"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/e6f386d5d54f","executable":false,"sourceId":"e6f386d5d54f","verification":"catalogued","source":"vulncheck-kev","modified":"2024-01-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"e6f386d5d54f","modified":"2024-01-10T00:00:00Z","url":"https://vulncheck.com/xdb/e6f386d5d54f"}],"repositoryUrl":"https://github.com/Chocapikk/CVE-2024-21893-to-CVE-2024-21887"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/ec7c4cca84d9","executable":false,"sourceId":"ec7c4cca84d9","verification":"catalogued","source":"vulncheck-kev","modified":"2024-01-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"ec7c4cca84d9","modified":"2024-01-10T00:00:00Z","url":"https://vulncheck.com/xdb/ec7c4cca84d9"}],"repositoryUrl":"https://github.com/zwxxb/CVE-2024-21887"},{"kind":"vulncheck-xdb","url":"https://vulncheck.com/xdb/a72604a4ced0","executable":false,"sourceId":"a72604a4ced0","verification":"catalogued","source":"vulncheck-kev","modified":"2024-01-10T00:00:00Z","origins":[{"source":"vulncheck-kev","sourceId":"a72604a4ced0","modified":"2024-01-10T00:00:00Z","url":"https://vulncheck.com/xdb/a72604a4ced0"}],"repositoryUrl":"https://github.com/7aRanchi/PublicPoC"}],"poc_candidates":[{"url":"https://github.com/oways/ivanti-CVE-2024-21887","source":"poc-in-github","sourceId":"CVE-2024-21887","description":"POC Checker for ivanti CVE-2024-21887 Command injcetion","modified":"2025-12-31T04:40:49Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-21887","url":"https://github.com/oways/ivanti-CVE-2024-21887"},{"source":"poc-in-github","sourceId":"CVE-2024-21887","modified":"2025-12-31T04:40:49Z","url":"https://github.com/oways/ivanti-CVE-2024-21887"}],"tags":[]},{"url":"https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887","source":"poc-in-github","sourceId":"CVE-2024-21887","description":"An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.","modified":"2026-02-03T03:08:39Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-21887","url":"https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887"},{"source":"poc-in-github","sourceId":"CVE-2024-21887","modified":"2026-02-03T03:08:39Z","url":"https://github.com/duy-31/CVE-2023-46805_CVE-2024-21887"}],"tags":[]},{"url":"https://github.com/Chocapikk/CVE-2024-21887","source":"poc-in-github","sourceId":"CVE-2024-21887","description":"A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.","modified":"2026-08-10T14:45:07Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-21887","url":"https://github.com/Chocapikk/CVE-2024-21887"},{"source":"poc-in-github","sourceId":"CVE-2024-21887","modified":"2026-08-10T14:45:07Z","url":"https://github.com/Chocapikk/CVE-2024-21887"}],"tags":[]},{"url":"https://github.com/raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887","source":"poc-in-github","sourceId":"CVE-2024-21887","description":"The script in this repository only checks whether the vulnerabilities specified in the Ivanti Connect Secure product exist.","modified":"2024-12-31T18:42:04Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-21887","url":"https://github.com/raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887"},{"source":"poc-in-github","sourceId":"CVE-2024-21887","modified":"2024-12-31T18:42:04Z","url":"https://github.com/raminkarimkhani1996/CVE-2023-46805_CVE-2024-21887"}],"tags":[]},{"url":"https://github.com/seajaysec/Ivanti-Connect-Around-Scan","source":"poc-in-github","sourceId":"CVE-2024-21887","description":"Mitigation validation utility for the Ivanti Connect Around attack chain. Runs multiple checks. CVE-2023-46805, CVE-2024-21887.","modified":"2024-04-05T07:44:30Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-21887","url":"https://github.com/seajaysec/Ivanti-Connect-Around-Scan"},{"source":"poc-in-github","sourceId":"CVE-2024-21887","modified":"2024-04-05T07:44:30Z","url":"https://github.com/seajaysec/Ivanti-Connect-Around-Scan"}],"tags":[]},{"url":"https://github.com/pwniel/ivanti_shell","source":"poc-in-github","sourceId":"CVE-2024-21887","description":"CVE-2024-21887 Exploitation with Ngrok Reverse Shell","modified":"2025-11-18T10:35:16Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-21887","url":"https://github.com/pwniel/ivanti_shell"},{"source":"poc-in-github","sourceId":"CVE-2024-21887","modified":"2025-11-18T10:35:16Z","url":"https://github.com/pwniel/ivanti_shell"}],"tags":[]},{"url":"https://github.com/rxwx/pulse-meter","source":"poc-in-github","sourceId":"CVE-2024-21887","description":"Parses the System Snapshot from an Ivanti Connect Secure applicance to identify possible IOCs related to CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.","modified":"2025-02-21T16:57:58Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-21887","url":"https://github.com/rxwx/pulse-meter"},{"source":"poc-in-github","sourceId":"CVE-2024-21887","modified":"2025-02-21T16:57:58Z","url":"https://github.com/rxwx/pulse-meter"}],"tags":[]},{"url":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser","source":"poc-in-github","sourceId":"CVE-2024-21887","description":"A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, and CVE-2024-21887.","modified":"2026-10-17T10:30:30Z","verification":"unverified","origins":[{"source":"poc-in-github","sourceId":"CVE-2024-21887","url":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser"},{"source":"poc-in-github","sourceId":"CVE-2024-21887","modified":"2026-10-17T10:30:30Z","url":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser"}],"tags":[]}],"test_commands":[{"tool":"nuclei","cmd":"nuclei -id CVE-2024-21887 -u https://TARGET","note":"Detection template — review its checks and affected versions before use."},{"tool":"poc.json","cmd":"curl -s https://vulnpedia.com/cve/CVE-2024-21887/poc.json","note":"Machine-readable PoC index for this CVE (for automation)."}],"detection_sources":[{"kind":"nuclei","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-21887.yaml","template":"http/cves/2024/CVE-2024-21887.yaml","executable":true}],"discovery_links":[{"kind":"github-search","url":"https://github.com/search?q=%22CVE-2024-21887%22&type=repositories","executable":false}]}