Ivanti Endpoint Manager CVE-2025-62383

Exploitation requires the attacker to hold valid Ivanti Endpoint Manager authentication credentials (CVSS PR:L), so this is an authenticated SQL injection rather than a fully anonymous attack - the vulnerability affects EPM versions from 2024 through 2024 SU3 Security Release 1 and is fixed in 2024 SU5. No user interaction is needed (UI:N) and the vector is network-reachable (AV:N) with low complexity (AC:L), but impact is limited to reading arbitrary database data (C:H, I:N, A:N) - the flaw does not permit data modification or service disruption. The primary limiting factor is the credential requirement; the realistic risk is highest where low-privileged EPM accounts are broadly provisioned or where credentials can be obtained through reuse, phishing, or a separate access vector.

This is a moderate-priority vulnerability with converging-but-unremarkable risk signals. The CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) reflects network-reachable, low-complexity exploitation that nonetheless REQUIRES valid authentication (PR:L) and yields confidentiality-only impact (C:H/I:N/A:N) - consistent with a read-only SQL injection that exposes database contents but does not modify data or disrupt availability. The EPSS score of 0.83% (56th percentile) indicates low near-term exploitation probability, and this CVE is NOT listed in CISA KEV, so there is no confirmed active exploitation. No public exploit code is referenced in the provided data. The signals are mutually consistent rather than conflicting: a privilege-requiring, info-disclosure bug in enterprise management software, low EPSS, no KEV - this is a genuine issue to patch on a normal cycle, not an emergency. The main risk amplifier is the product itself: Ivanti Endpoint Manager is a privileged IT-management platform whose database can hold sensitive asset, credential, and configuration data, so arbitrary read access is more consequential than a 6.5 implies. The required authentication is the key limiting factor; an attacker must already possess valid EPM credentials (or chain this with a separate auth bypass).

An attacker holding valid but low-privileged Ivanti Endpoint Manager credentials (or using credentials harvested via phishing/reuse) sends a crafted request to an injectable EPM endpoint, manipulating a backend SQL query to read records they are not authorized to access. This lets them exfiltrate sensitive database contents such as managed-device inventory, administrative configuration, or stored secrets. No public exploit identified at time of analysis, so exploitation would require the attacker to independently develop the injection payload.