Ivanti Endpoint Manager CVE-2025-13661

Exploitation requires the attacker to already possess valid authenticated access to Ivanti Endpoint Manager (CVSS PR:L) and additionally requires a legitimate user to perform an action (CVSS UI:R) for the file-write to complete - both are significant limiting factors against unauthenticated or fully automated attacks. The affected component is the path-handling logic that writes files; the flaw is a path-traversal (CWE-22) allowing writes outside the intended directory. Affected deployments are Ivanti Endpoint Manager 2024 through 2024 SU4 (including SU1, SU2, SU3, and SU3 Security Release 1); fixed in 2024 SU4 SR1. No specific non-default feature toggle is named in the advisory description, so the condition is primarily holding authenticated access plus triggering the required user interaction against an unpatched EPM server.

This is a credible, above-average priority issue but not a drop-everything emergency based on current signals. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H, base 8.0 HIGH) indicates network-reachable exploitation with low attack complexity, but two meaningful brakes exist: PR:L means the attacker must already hold valid authenticated credentials, and UI:R means a legitimate user must perform some action to complete the attack. No EPSS score was supplied, so exploitation probability cannot be quantified. KEV status is not present in the input, so there is no evidence of active exploitation - treat it as not CISA-KEV-listed. No POC indicator was provided. No SSVC decision data (exploitation/automatable/technical impact) was supplied. The combination of required authentication plus required user interaction argues against trivial mass exploitation and points toward a more targeted or chained-access scenario, even though the arbitrary-file-write primitive is powerful and can plausibly escalate to code execution on a core management server. Net: a real, patch-worthy HIGH with strong impact potential, tempered by authentication and user-interaction prerequisites and the absence of any exploitation-probability or KEV signal to confirm urgency.

An authenticated attacker with low-privileged access to an Ivanti Endpoint Manager instance submits a crafted request containing a path-traversal sequence, and when a legitimate user performs the required interaction the input is written as an arbitrary file outside the intended directory. By writing to a sensitive location (e.g., a web-executable or startup path), the attacker can corrupt configuration or stage code execution on the management server. No public exploit code was identified in the provided data.