CVE-2024-38648 | BDVDB-2026-285950 Detail

IvantiDSM

Description#

A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.

Impact#

Per CVSS v3.0: confidentiality impact high, integrity impact high, availability impact high. Attack vector: adjacent.

Weaknesses#

CWE-798 Use of Hard-coded Credentials

References#

https://forums.ivanti.com/s/article/SA-2024-07-12-CVE-2024-38648

Exploit#

No public exploit known

History#

Version 12025-07-12Record published in the CVE List.
Version 22025-07-14Most recent update recorded in the CVE List.

Published

Published: 2025-07-12
Last modified: 2025-07-14

Vendor information

Vendor: Ivanti
Product: DSM

All Ivanti vulnerabilities

Score

9.0 Critical

EPSS

less than 1%, Very Low

Estimated chance of exploitation in the next 30 days. EPSS percentile: 48.3.

KEV

Not listed in the CISA Known Exploited Vulnerabilities catalog.

Impact

Hard-coded Credentials

Action

No specific action is recorded in the source data. Check the references for vendor guidance.

Affected Systems

Vulnerable
>= 2024.2 and < 2024.2
Fixed
2024.2

Scoring System

CVSS v4.0

Not available

CVSS v3.1

Not available

CVSS v3.0

9.0 Critical

CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Metric breakdown
Attack Vector	Adjacent
Attack Complexity	Low
Privileges Required	Low
User Interaction	None
Scope	Changed
Confidentiality	High
Integrity	High
Availability	High

CVSS v2

Not available

Source: CVE List v5 (record); CISA KEV (kev, action); FIRST EPSS (epss).