Category: US Computer Emergency Readiness Team

News In Brief – Source: US Computer Emergency Readiness Team

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 7.4
• ATTENTION: Exploitable remotely
• Vendor: Siemens
• Equipment: Mendix LDAP
• Vulnerability: LDAP Injection

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an unauthenticated remote attacker to bypass username verification.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

• Siemens Mendix LDAP: All versions prior to 1.1.2

3.2 VULNERABILITY OVERVIEW

3.2.1 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN LDAP QUERY (‘LDAP INJECTION’) CWE-90

Affected versions of the module are vulnerable to LDAP injection. This could allow an unauthenticated remote attacker to bypass username verification.

CVE-2024-56841 has been assigned to this vulnerability. A CVSS v3 base score of 7.4 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing, Energy
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens reported this vulnerability to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-314390 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability has a high attack complexity.

5. UPDATE HISTORY

• January 16, 2025: Initial Publication

News In Brief – Source: US Computer Emergency Readiness Team

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v3 4.9
• ATTENTION: Exploitable remotely/low attack complexity
• Vendor: Hitachi Energy
• Equipment: FOX61x Products
• Vulnerability: Relative Path Traversal

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to traverse the file system to access files or directories that would otherwise be inaccessible.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Hitachi Energy reports the following products are affected:

• Hitachi Energy FOX61x: R15A and prior
• Hitachi Energy FOX61x: R15B
• Hitachi Energy FOX61x: R16A
• Hitachi Energy FOX61x: R16B Revision E

3.2 VULNERABILITY OVERVIEW

3.2.1 RELATIVE PATH TRAVERSAL CWE-23

Hitachi Energy is aware of a vulnerability that affects the FOX61x. If exploited an attacker could traverse the file system to access files or directories that would otherwise be inaccessible.

CVE-2024-2461 has been assigned to this vulnerability. A CVSS v3 base score of 4.9 has been assigned; the CVSS vector string is (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Switzerland

3.4 RESEARCHER

Hitachi Energy PSIRT reported this vulnerability to CISA.

4. MITIGATIONS

Hitachi Energy has identified the following specific workarounds and mitigations users can apply to reduce risk:

• FOX61x R16B Revision E (cesm3_r16b04_02, cesne_r16b04_02 and f10ne_r16b04_02) and older: Update to FOX61x R16B Revision G, Version (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07) and apply general mitigation factors. (Hitachi Energy recommends that users apply the update at the earliest convenience).
• FOX61x R15B: Recommended to update to FOX61X R16B Revision G, (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07) and apply general mitigation factors.
• FOX61x R15A and older including all subversions, FOX61x R16A: EOL versions – no remediation will be available. Recommended to update to FOX61X R16B Revision G, (cesm3_r16b04_07, cesne_r16b04_07, f10ne_r16b04_07) and apply general mitigation factors.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

CISA also recommends users take the following measures to protect themselves from social engineering attacks:

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time.

5. UPDATE HISTORY

• January 16, 2025: Initial Publication

News In Brief – Source: US Computer Emergency Readiness Team

CISA released twelve Industrial Control Systems (ICS) advisories on January 16, 2025. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS.

CISA encourages users and administrators to review newly released ICS advisories for technical details and mitigations.

News In Brief – Source: US Computer Emergency Readiness Team

As of January 10, 2023, CISA will no longer be updating ICS security advisories for Siemens product vulnerabilities beyond the initial advisory. For the most up-to-date information on vulnerabilities in this advisory, please see Siemens’ ProductCERT Security Advisories (CERT Services | Services | Siemens Global).

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 5.2
• ATTENTION: Exploitable locally
• Vendor: Siemens
• Equipment: Siveillance Video Camera Drivers
• Vulnerability: Insertion of Sensitive Information into Log File

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow a local attacker to read camera credentials stored in the Recording Server under specific conditions.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

Siemens reports that the following products are affected:

• Siveillance Video Device Pack: Versions prior to V13.5

3.2 VULNERABILITY OVERVIEW

3.2.1 INSERTION OF SENSITIVE INFORMATION INTO LOG FILE CWE-532

Disclosure of sensitive information in HikVision camera driver’s log file in XProtect Device Pack allows an attacker to read camera credentials stored in the Recording Server under specific conditions.

CVE-2024-12569 has been assigned to this vulnerability. A CVSS v3 base score of 7.8 has been assigned; the CVSS vector string is (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-12569. A base score of 5.2 has been calculated; the CVSS vector string is (CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:N/SC:H/SI:H/SA:H).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Commercial Facilities, Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Germany

3.4 RESEARCHER

Siemens ProductCERT reported this vulnerability to CISA.

4. MITIGATIONS

Siemens has identified the following specific workarounds and mitigations users can apply to reduce risk:

• Ensure that only trusted people get local access to the driver log files on the Recording Server.
• Update to V13.5 or later version.

As a general security measure, Siemens recommends protecting network access to devices with appropriate mechanisms. To operate the devices in a protected IT environment, Siemens recommends configuring the environment according to Siemens’ operational guidelines for industrial security and following recommendations in the product manuals.

Additional information on industrial security by Siemens can be found on the Siemens industrial security webpage

For more information see the associated Siemens security advisory SSA-404759 in HTML and CSAF.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs). Recognize VPNs may have vulnerabilities, should be updated to the most recent version available, and are only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely. This vulnerability has a high attack complexity.

5. UPDATE HISTORY

• January 16, 2025: Initial Publication

News In Brief – Source: US Computer Emergency Readiness Team

View CSAF

1. EXECUTIVE SUMMARY

• CVSS v4 8.5
• ATTENTION: Low attack complexity
• Vendor: Fuji Electric
• Equipment: Alpha5 SMART
• Vulnerability: Stack-based Buffer Overflow

2. RISK EVALUATION

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code.

3. TECHNICAL DETAILS

3.1 AFFECTED PRODUCTS

The following versions of Fuji Electric Alpha5 SMART, a servo drive system, are affected:

• Alpha5 SMART: Versions 4.5 and prior

3.2 VULNERABILITY OVERVIEW

3.2.1 STACK-BASED BUFFER OVERFLOW CWE-121

The affected product is vulnerable to a stack-based buffer overflow, which may allow an attacker to execute arbitrary code.

CVE-2024-34579 has been assigned to this vulnerability. A CVSS v3.1 base score of 7.8 has been calculated; the CVSS vector string is (AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A CVSS v4 score has also been calculated for CVE-2024-34579. A base score of 8.5 has been calculated; the CVSS vector string is (CVSS4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N).

3.3 BACKGROUND

• CRITICAL INFRASTRUCTURE SECTORS: Critical Manufacturing
• COUNTRIES/AREAS DEPLOYED: Worldwide
• COMPANY HEADQUARTERS LOCATION: Japan

3.4 RESEARCHER

An anonymous researcher working with Trend Micro’s Zero Day Initiative reported this vulnerability to CISA.

4. MITIGATIONS

Fuji Electric has indicated that the vulnerabilities will not be fixed in Alpha5 SMART. Fuji Electric recommends users upgrade their systems to Alpha7.

For assistance, reach out directly to Fuji Electric’s support team.

CISA recommends users take defensive measures to minimize the risk of exploitation of this vulnerability, such as:

• Minimize network exposure for all control system devices and/or systems, ensuring they are not accessible from the Internet.
• Locate control system networks and remote devices behind firewalls and isolating them from business networks.
• When remote access is required, use more secure methods, such as Virtual Private Networks (VPNs), recognizing VPNs may have vulnerabilities and should be updated to the most current version available. Also recognize VPN is only as secure as the connected devices.

CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures.

CISA also provides a section for control systems security recommended practices on the ICS webpage on cisa.gov/ics. Several CISA products detailing cyber defense best practices are available for reading and download, including Improving Industrial Control Systems Cybersecurity with Defense-in-Depth Strategies.

CISA encourages organizations to implement recommended cybersecurity strategies for proactive defense of ICS assets.

Additional mitigation guidance and recommended practices are publicly available on the ICS webpage at cisa.gov/ics in the technical information paper, ICS-TIP-12-146-01B–Targeted Cyber Intrusion Detection and Mitigation Strategies.

Organizations observing suspected malicious activity should follow established internal procedures and report findings to CISA for tracking and correlation against other incidents.

No known public exploitation specifically targeting this vulnerability has been reported to CISA at this time. This vulnerability is not exploitable remotely.

5. UPDATE HISTORY

• January 16, 2025: Initial Publication

News In Brief – Source: US Computer Emergency Readiness Team

Guides organizations with using new logging capabilities to detect and defend against sophisticated cyber threat actors

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA), in close coordination with the Office of Management and Budget (OMB), Office of the National Cyber Director (ONCD) and Microsoft, announces today the release of Microsoft Expanded Cloud Log Implementation Playbook. This guidance helps public and private sector organizations using Microsoft Purview Audit (Standard) to operationalize newly available cloud logs to be an actionable part of their enterprise cybersecurity operations.

The playbook provides guidance on each newly available log and how these logs can be enabled and operationalized to support threat hunting and incident-response operations. It provides organizations with scenario-based analysis on the common tactics related to identity-based compromises. It also provides best practices to navigate M365 logs and perform administrator actions to enable the logs to help cyber defenders detect malicious activity.

“CISA is pleased to provide this playbook to help organizations effectively use newly introduced Microsoft security logs to strengthen their cyber defense. We value the collaboration with our government partners and Microsoft which informed this valuable resource,” said CISA Director Jen Easterly. “Necessary security logs are critical for all organizations to protect their networks. We are pleased to see this progress and continue work to ensure greater adoption of Secure by Design principles.”

“Today’s release of the playbook is a result of close collaboration with our federal and private sector partners,” said National Cyber Director Harry Coker Jr. “The upgraded logging features available will enable network defenders to enhance their threat detection capabilities. Every organization should bolster their security and this playbook is another step in the right direction to achieve those goals.”

“With the final publication of the Enhanced Logging Playbook, we are not only providing the critical tools to detect ever-evolving cyber threats through advanced audit logs, but providing the resources necessary to help our defenders to effectively leverage these tools to protect their networks,” said Candice Ling, Senior Vice President, Microsoft Federal. “Microsoft remains committed to partnering with the federal government to prioritize security above all else.”

In 2023, Microsoft announced expanded cloud logging for public entities using Microsoft Purview Audit (Standard) regardless of Microsoft license tier. Last year, CISA announced that Federal Civilian Executive Branch agencies had expanded cloud logging capabilities. Previously, these logs were only available to Audit Premium subscription customers. 

Secure by Design is integral to helping organizations better defend their networks from malicious cyber actors. With our government and industry partners, CISA continues our work to ensure every organization has access to key security data by default and products that are secure by design.

Organizations using Microsoft E3/G3-and-above licensing are encouraged to review this guide.

###

About CISA 

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day.

Visit CISA.gov for more information and follow us on X, Facebook, LinkedIn, Instagram. 

News In Brief – Source: US Computer Emergency Readiness Team

WASHINGTON – The Cybersecurity and Infrastructure Security Agency (CISA) published today the Joint Cyber Defense Collaborative (JCDC) Artificial Intelligence (AI) Cybersecurity Collaboration Playbook. Developed alongside federal, international, and private-sector partners through JCDC, this playbook provides the AI community—including AI providers, developers, and adopters—with essential guidance on how to voluntarily share actionable incident information and it describes how proactive information sharing can enhance operational collaboration and improve resilience of AI systems.  

As AI adoption accelerates, new vulnerabilities and risks will continue to emerge, reshaping the threat landscape for AI-enabled systems. The playbook will be a living document, fostering collaboration across government, industry, and international partners and adapting to meet the challenges of an evolving AI security environment. 

The AI Cybersecurity Collaboration Playbook will: 

• Guide JCDC Partners on how to voluntarily share information related to incidents and vulnerabilities associated with AI systems. 
• Clearly explain the actions CISA may take after receiving shared information. 
• Facilitate collaboration to raise awareness of AI cybersecurity risks across critical infrastructure, enhancing the security and resilience of AI technologies. 

“The development of this playbook is a major milestone in our efforts to secure AI systems through active collaboration,” said CISA Director Jen Easterly. “Led by JCDC.AI, this playbook was shaped by the insights and expertise of approximately 150 AI specialists from government, industry, and international partners who participated in two dynamic tabletop exercises. This playbook will be regularly updated to address the evolving challenges of an AI-driven future.” 

The two JCDC.AI tabletop exercises, hosted by Microsoft and Scale AI, provided real-world scenarios that helped refine the playbook and ensure it addresses the complex challenges unique to AI security. This playbook aligns with the CISA Roadmap for AI and the 2024 JCDC Priorities, which focus on building robust public-private collaboration to address emerging AI cybersecurity risks. 

“This collaboration between government and industry is essential for building a robust response to the complex and evolving landscape of AI security threats. The AI Security Incident Collaboration Playbook, combined with our continued joint efforts, will serve as a critical framework for developing agile and proactive defense strategies, ensuring the integrity and resilience of AI technologies.” – Omar Santos, Distinguished Engineer, Cisco

“Security for AI isn’t a solo mission; it’s a collective effort. Hidden Layer is proud to partner with JCDC in setting the standard for how AI developers, providers, and adopters can work together in real-time to combat an increasingly dynamic threat landscape. By bridging gaps and fostering direct collaboration across sectors, this playbook empowers each of us to contribute to a more secure AI ecosystem—one that’s built not just to respond to threats but to stay ahead of them.” – Malcolm Harkins, Chief Security & Trust Officer at Hidden Layer

“Fully harnessing the enormous potential of AI requires dedicated investment in the processes, collaboration, and tools to secure the AI infrastructure that will underpin our digital way of life. To that end, Palo Alto Networks appreciates the opportunity to contribute to the AI Cybersecurity Collaboration Playbook. Products like these underscore the critical role that forums like CISA’s JCDC can play in our collective defense.” – Daniel Kroese, VP Public Policy and Government Affairs, Palo Alto Networks

“At Protect AI, we are committed to building a safer AI-powered world and shaping the future of AI security across industries. This playbook is an essential tool for helping organizations navigate the complexities of deploying AI safely and understanding how to respond quickly to AI related incidents. We are honored to contribute to its development. We will continue supporting CISA’s efforts to ensure its evolution, empowering organizations to implement secure-by-design AI without stifling AI-driven innovation.” – Diana Kelley, CISO, Protect AI

“As AI technology evolves, so must our security practices. Stability AI’s partnership with JCDC represents our commitment to developing comprehensive safeguards that protect users while enabling technological progress.” – Ryan Holeman, CISO, Stability AI

For more information, visit CISA’s Artificial Intelligence and JCDC webpages.   

###

About CISA 

As the nation’s cyber defense agency and national coordinator for critical infrastructure security, the Cybersecurity and Infrastructure Security Agency leads the national effort to understand, manage, and reduce risk to the digital and physical infrastructure Americans rely on every hour of every day.

Visit CISA.gov for more information and follow us on X, Facebook, LinkedIn, Instagram. 

News In Brief – Source: US Computer Emergency Readiness Team

Today, CISA—along with U.S. and international partners—released joint guidance Secure by Demand: Priority Considerations for Operational Technology Owners and Operators when Selecting Digital Products. As part of CISA’s Secure by Demand series, this guidance focuses on helping customers identify manufacturers dedicated to continuous improvement and achieving a better cost balance, as well as how Operational Technology (OT) owners and operators should integrate secure by design elements into their procurement process.

Critical infrastructure and industrial control systems are prime targets for cyberattacks. The authoring agencies warn that threat actors, when compromising OT components, target specific OT products rather than specific organizations. Many OT products are not designed and developed with Secure by Design principles and often have easily exploited weaknesses. When procuring products, OT owners and operators should select products from manufacturers who prioritize security elements identified in this guidance.

For more information on questions to consider during procurement discussions, see CISA’s Secure by Demand Guide: How Software Customers Can Drive a Secure Technology Ecosystem. To learn more about secure by design principles and practices, visit Secure by Design.

News In Brief – Source: US Computer Emergency Readiness Team

Today, CISA released the Cybersecurity Performance Goals Adoption Report to highlight how adoption of Cybersecurity Performance Goals (CPGs) benefits our nation’s critical infrastructure sectors. Originally released in October 2022, CISA’s CPGs are voluntary practices that critical infrastructure owners can take to protect themselves against cyber threats. 

This report is based on analysis of 7,791 critical infrastructure organizations enrolled in CISA’s Vulnerability Scanning service from Aug. 1, 2022, through Aug. 31, 2024. Data reveals that four critical infrastructure sectors are most impacted by CPG adoption: Healthcare and Public Health, Water and Wastewater Systems, Communications, and Government Services and Facilities. These four sectors have strong partnerships with CISA.

As CISA strengthens partnerships across all 16 critical infrastructure sectors, the agency hopes that CPG adoption will continue to expand. CISA urges critical infrastructure to learn more by visiting Cross-Sector Cybersecurity Performance Goals. 

News In Brief – Source: US Computer Emergency Readiness Team

Ivanti released security updates to address vulnerabilities (CVE-2025-0282, CVE-2025-0283) in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. A cyber threat actor could exploit CVE-2025-0282 to take control of an affected system.

CISA has added CVE-2025-0282 to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation.

CISA urges organizations to hunt for any malicious activity, report any positive findings to CISA, and review the following for more information:

For all instances of Ivanti Connect Secure, Policy Secure, and ZTA Gateways, see the following steps for general hunting guidance:

1. Conduct threat hunting actions:  
   1. Run the In-Build Integrity Checker Tool (ICT). Instructions can be found here. 
   2. Conduct threat hunt actions on any systems connected to—or recently connected to—the affected Ivanti device.  
2. If threat hunting actions determine no compromise: 
   1. Factory reset the device and apply the patch described in Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283). 
   2. Monitor the authentication or identity management services that could be exposed. 
   3. Continue to audit privilege level access accounts. 
3. If threat hunting actions determine compromise: 
   1. Report to CISA and Ivanti immediately to start forensic investigation and incident response activities.  
   2. Disconnect instances of affected Ivanti Connect Secure products.  
   3. Isolate the systems from any enterprise resources to the greatest degree possible. 
   4. Revoke and reissue any connected or exposed certificates, keys, and passwords, to include the following: 
      1. Reset the admin enable password. 
      2. Reset stored application programming interface (API) keys. 
      3. Reset the password of any local user defined on the gateway, including service accounts used for auth server configuration(s).  
   5. If domain accounts associated with the affected products have been compromised: 
      1. Reset passwords twice for on premise accounts, revoke Kerberos tickets, and then revoke tokens for cloud accounts in hybrid deployments. 
      2. For cloud joined/registered devices, disable devices in the cloud to revoke the device tokens.
   6. After investigation, fully patch and restore system to service.

Organizations should report incidents and anomalous activity to CISA’s 24/7 Operations Center at Report@cisa.gov or (888) 282-0870. When available, please include the following information regarding the incident: date, time, and location of the incident; type of activity; number of people affected; type of equipment used for the activity; the name of the submitting company or organization; and a designated point of contact.