CVE-2024-38648

State: Published
Severity: 9.0 Critical
Published: Jul 12, 2025
Updated: Jul 14, 2025
Reserved: Jun 19, 2024

Description

A hardcoded secret in Ivanti DSM before 2024.2 allows an authenticated attacker on an adjacent network to decrypt sensitive data including user credentials.

Scores

CVSS	Score	Vector	Source
3.0	9.0 Critical	CVSS:3.0/AV:A/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	hackerone

Weaknesses

CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
DSMIvanti	2024.2 to before 2024.2Affected

References

https://forums.ivanti.com/s/article/SA-2024-07-12-CVE-2024-38648

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.