CVE-2024-38648

CVSS 9 CRITICALEPSS 0.6%CWE-798

Vexday Risk Score

28Low

SSVC decision (CISA)

Track

No exploitation signal → monitor

CVSS 9EPSS 0.6%KEV nãoPoC —Nuclei —Metasploit —Patch —

Lifecycle

12 Jul 2025Published on NVD

Recommendation: Monitor — no exploitation signal at the moment.

A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected products

Ivanti · DSM

Want to know if your infrastructure is exposed to this?

Talk to TrueHacking →

References

https://forums.ivanti.com/s/article/SA-2024-07-12-CVE-2024-38648