Ivanti Endpoint Manager CVE-2025-62385

Exploitation requires the attacker to possess valid authenticated access to Ivanti Endpoint Manager (CVSS PR:L), so only a user already able to log in to the EPM application - legitimately or via stolen/low-privilege credentials - can trigger the SQL injection; no user interaction and no non-default configuration are indicated. The vulnerability affects Ivanti Endpoint Manager 2024 and its service updates up to and including SU3 (per the CPE list: 2024, SU1, SU2, SU3, SU3 Security Release 1), and is fixed in 2024 SU5, so the primary limiting factor beyond authentication is running an unpatched build older than 2024 SU5. Impact is confined to reading database contents (C:H, I:N, A:N) - no data modification or service disruption.

This is a moderate-risk, authenticated information-disclosure flaw rather than a top-tier emergency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent: network-reachable, low complexity, but requiring low-level authentication (PR:L), with confidentiality-only impact (C:H, I:N, A:N) - matching the description of a remote authenticated attacker reading arbitrary database data via SQL injection. The signals align rather than conflict: EPSS is low at 0.82% (56th percentile), there is no CISA KEV listing and no public exploit identified at time of analysis, so there is no evidence of active or imminent mass exploitation. No SSVC decision data was provided in the input, so exploitation status/automatable/technical-impact cannot be independently cited. The key limiting factor is the PR:L authentication requirement, which bars anonymous internet attackers and makes this most relevant as a post-authentication or insider/credential-theft escalation path. Given Ivanti products' history of being targeted after patch release, this should be patched promptly (to 2024 SU5) but does not rise to drop-everything priority absent exploitation evidence.

An attacker who already holds valid low-privilege credentials to the Ivanti Endpoint Manager web interface submits a crafted request containing malicious SQL that is passed unsanitized into a backend query. Because the injection returns data, the attacker reads arbitrary tables - potentially credentials, device inventory, or configuration secrets - without needing to modify data or interact with any user. No public proof-of-concept was identified at time of analysis, so exploitation currently requires the attacker to independently discover the vulnerable parameter.