KNOWN EXPLOITED VULNERABILITY DOSSIER
CVE-2023-46805
Ivanti · Connect Secure (ICS)
Authentication bypass vulnerability in the web components of Ivanti Connect Secure allowing attackers to bypass control checks.
Correlated Federal Court Cases & Exploitation Context (1)
Docket CISA-AA24-038A · Federal Law Enforcement Action / FISA Court Authorized Operations
Volt Typhoon Critical Infrastructure Pre-Positioning State-sponsored cyber group sponsored by the People's Republic of China breached dozens of U.S. critical infrastructure operators in communications, energy, transportation, and water systems to establish disruptive persistent access.
Exploitation Ground Zero: Exploitation of zero-day vulnerabilities in edge networking appliances (Fortinet, Ivanti, Cisco, NETGEAR routers) combined with the KV-botnet of compromised small-office/home-office (SOHO) routers used as obfuscation proxies.
Operational Impact: Pre-positioned inside critical infrastructure facilities across the United States and Guam, including drinking water treatment plants, telecommunications switching hubs, electric utility grids, and maritime port facilities. The objective was not financial extortion or immediate espionage, but dormant pre-positioning for disruptive sabotage during a potential geopolitical crisis.
Sector: Communications, Energy, Transportation, Water, Defense Industrial Base · Loss: $150.0 million
Inspect Full Case Dossier →
Associated Government Advisories
- AA24-010A CISA Alert →