Ivanti Endpoint Manager CVE-2025-62388

Exploitation requires an authenticated session to Ivanti Endpoint Manager at a low privilege level (CVSS PR:L) and a build before 2024 SU5 (affected: 2024 base, SU1, SU2, SU3, and SU3 Security Release 1). No user interaction is needed (UI:N) and no non-default configuration is called out in the advisory, so any reachable EPM instance on an affected version is in scope. The principal limiting factor is the authentication requirement: the attacker must first obtain valid (even low-privilege) credentials or an active session, which constrains this to insiders, credential-phishing/reuse scenarios, or chaining after another access-granting flaw. Impact is read-only (I:N/A:N), limiting the attacker to data disclosure rather than modification or denial of service.

This is a moderate-severity, authenticated SQL injection (CWE-89) in Ivanti Endpoint Manager. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, base 6.5) is internally consistent: network-reachable, low attack complexity, but requiring low-level authentication (PR:L) and yielding only confidentiality impact (C:H, I:N, A:N) - consistent with a read-only 'read arbitrary data from the database' primitive. EPSS is low (0.82%, 56th percentile), there is no CISA KEV listing, and no public exploit identified at time of analysis, so this reads as a real-but-not-urgent issue rather than a mass-exploitation priority. The signals are aligned rather than conflicting: low EPSS, no KEV, and the PR:L authentication requirement all temper the network attack vector. The tempering factor to weigh is Ivanti EPM's history as a repeatedly targeted enterprise product - authenticated flaws in it have been chained before - so for organizations where low-privilege access is easy to obtain, the arbitrary-database-read capability (potential credential/config disclosure) raises practical risk above what the base score alone suggests.

An attacker who already holds low-privilege authenticated access to the Ivanti Endpoint Manager application submits crafted input to a vulnerable parameter, injecting SQL that the backend executes against the management database. The attacker then reads arbitrary data - potentially including managed-device inventory, configuration, and credential material - without needing additional privileges or user interaction. No public exploit code has been identified, so exploitation currently requires the attacker to independently discover the injectable parameter.