Ivanti Endpoint Manager CVE-2025-62384

Exploitation requires valid authenticated access to the Ivanti Endpoint Manager application with at least low privileges (CVSS PR:L) - it is NOT exploitable by unauthenticated attackers. The affected versions are Ivanti Endpoint Manager 2024 and its service updates up to and including SU3 (security release 1), i.e., any build before 2024 SU5. No user interaction is required (UI:N) and the attack is over the network against the application interface (AV:N) with low complexity (AC:L). The primary limiting factor is the authentication requirement; impact is bounded to reading data (confidentiality only), with no write or availability effect.

This is a medium-severity (CVSS 6.5) SQL injection confined to confidentiality impact (C:H/I:N/A:N) - an authenticated attacker can read arbitrary database contents but cannot modify data or disrupt availability. The CVSS vector is internally consistent and aligns with the description: network vector (AV:N), low complexity (AC:L), and crucially PR:L, meaning valid low-privilege credentials to the EPM console are a hard prerequisite, which substantially narrows the real-world attacker population versus an unauthenticated flaw. The EPSS score of 0.83% (56th percentile) is low-to-moderate and consistent with the absence of both CISA KEV listing and any public proof-of-concept, indicating no evidence of active or imminent mass exploitation at time of analysis. No SSVC decision data was provided in the input. Net assessment: this is a legitimate but not emergency-tier issue - it should be patched on a normal prioritized cycle rather than treated as a drop-everything item, because exploitation requires prior authenticated access and only yields data disclosure. The main residual concern is that Ivanti EPM is an attractive, privileged management target, so a low-privilege account compromise chained with this flaw could expose sensitive managed-endpoint and credential data from the database.

An attacker who already holds low-privilege credentials to an Ivanti Endpoint Manager instance (e.g., a phished or weak operator account) submits a crafted request to a vulnerable parameter, injecting SQL that the backend executes against the EPM database. The attacker then reads arbitrary tables - potentially exfiltrating configuration, inventory, and credential-related data for managed endpoints. No public exploit code was identified at time of analysis, and exploitation depends on possessing valid authentication.