CVE-2024-8190

HIGH KEV

Ivanti Cloud Services Appliance <4.6.518 - Command Injection

Title source: llm
STIX 2.1

Exploitation Summary

CVE-2024-8190 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added September 13, 2024. EIP tracks 2 public exploits from researchers including horizon3ai, flyingllama87.

AI-analyzed exploit summary This PoC exploits an authenticated command injection vulnerability in Ivanti Cloud Service Appliance by injecting a command into the TIMEZONE parameter of a POST request to /gsb/datetime.php. It requires valid credentials and a CSRF token.

Description

An OS command injection vulnerability in Ivanti Cloud Services Appliance versions 4.6 Patch 518 and before allows a remote authenticated attacker to obtain remote code execution. The attacker must have admin level privileges to exploit this vulnerability.

Exploits (2)

nomisec WORKING POC 17 stars
by horizon3ai · remote-auth
https://github.com/horizon3ai/CVE-2024-8190

This PoC exploits an authenticated command injection vulnerability in Ivanti Cloud Service Appliance by injecting a command into the TIMEZONE parameter of a POST request to /gsb/datetime.php. It requires valid credentials and a CSRF token.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Ivanti Cloud Service Appliance
Auth required
Prerequisites: Valid credentials for the target application · Network access to the target
devstral-2 · analyzed Feb 16, 2026 Full analysis →
nomisec WORKING POC 2 stars
by flyingllama87 · remote-auth
https://github.com/flyingllama87/CVE-2024-8190-unauth

This PoC combines CVE-2024-8963 (path traversal) and CVE-2024-8190 (command injection) to achieve unauthenticated RCE on Ivanti CSA 4.6 and below. It bypasses authentication via path manipulation and injects commands into the TIMEZONE parameter.

Classification
Working Poc 95%
Attack Type
Rce
Complexity
Moderate
Reliability
Reliable
Target: Ivanti Cloud Services Appliance (CSA) versions 4.6 Patch 518 and below
No auth needed
Prerequisites: Network access to the target · Target running vulnerable Ivanti CSA version
devstral-2 · analyzed Feb 16, 2026 Full analysis →

Scores

CVSS v3 7.2
EPSS 0.8904
EPSS Percentile 99.8%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation active
Automatable no
Technical Impact total

Details

CISA KEV 2024-09-13
VulnCheck KEV 2024-09-13
InTheWild.io 2024-09-13
ENISA EUVD EUVD-2024-49004
CWE
CWE-78
Status published
Products (1)
ivanti/cloud_services_appliance 4.6 (2 CPE variants)
Published Sep 10, 2024
KEV Added Sep 13, 2024
Tracked Since Feb 18, 2026