Ivanti Endpoint Manager CVE-2025-62389

Exploitation requires valid authenticated access to Ivanti Endpoint Manager (CVSS PR:L), so the attacker must already possess working EPM credentials - this is the primary limiting factor and rules out anonymous internet exploitation. Affected deployments are Ivanti Endpoint Manager 2024 through 2024 SU3 (including SU1, SU2, SU3, and SU3 Security Release 1); upgrading to 2024 SU5 or later remediates the flaw. No special non-default feature or configuration toggle is identified in the description as a prerequisite, and no user interaction is required (UI:N); the impact is limited to reading database data (C:H, I:N, A:N), not modifying it.

This is a moderate-priority vulnerability rather than a top-tier emergency. The CVSS 3.1 base score of 6.5 (vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N) describes a network-reachable, low-complexity SQL injection requiring existing authenticated access (PR:L), with high confidentiality impact but no integrity or availability impact - consistent with the description that an authenticated attacker can read (but not modify) arbitrary database data. EPSS is 1.74% (77th percentile), which is elevated above baseline but still indicates relatively low near-term mass-exploitation probability; this is not currently listed in CISA KEV and no public exploit code was provided in the sources, so there is no evidence of active exploitation or weaponization. No SSVC decision data was supplied in the input, so exploitation-status/automatable/technical-impact cannot be assessed against that framework. The signals are internally consistent (authenticated network SQLi, confidentiality-only impact, modest EPSS, no KEV/POC), so there is no major conflict to flag; the main caveat is that Ivanti products have historically been heavily targeted, so the practical risk of this being chained after credential compromise is higher than the raw score alone implies.

An attacker who already holds valid (even low-privileged) Ivanti Endpoint Manager credentials sends a crafted request containing malicious SQL to a vulnerable input parameter, causing the backend database to return data the account should not be able to access. Because impact is confidentiality-only, the attacker reads sensitive database contents (e.g., managed-device inventory, configuration, or credential material) to support further intrusion. No public proof-of-concept exploit was identified in the provided sources.