Ivanti Virtual Application Delivery Controller Missing Authorization Vulnerability Allowing Admin Account Takeover

A vulnerability in the admin console of Ivanti Virtual Application Delivery Controller (vADC) prior to version 22.9 allows remote authenticated attackers to take over admin accounts by resetting passwords. This issue arises from missing authorization checks, enabling unauthorized password resets.

Impact

Exploitation of this vulnerability could lead to unauthorized password resets, allowing attackers to gain control of admin accounts.

Remediation

Users can upgrade to Ivanti Virtual Application Delivery Controller version 22.9, available on the Ivanti Download Portal. It is also recommended to restrict admin access to the management interface to the internal network.