Ivanti Endpoint Manager CVE-2025-62390

Exploitation requires an authenticated session on Ivanti Endpoint Manager: per the CVSS vector (PR:L) and the description ('remote authenticated attacker'), the attacker must possess at least a valid low-privilege EPM account before reaching the vulnerable SQL-handling functionality. No user interaction is needed (UI:N) and the attack is reachable over the network (AV:N) against affected versions (Ivanti EPM 2024 through SU3 Security Release 1, i.e. anything before 2024 SU5). The primary limiting factors are the mandatory authentication and the confidentiality-only impact - the flaw permits reading arbitrary database data but, per I:N/A:N, does not by itself allow data modification or service disruption. Risk is therefore concentrated in environments where EPM accounts are broadly provisioned or where credentials may be compromised.

This is a medium-severity, authenticated SQL injection (CWE-89) in Ivanti Endpoint Manager with a CVSS 3.1 score of 6.5 and vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The signals are internally consistent: the network attack vector (AV:N), low complexity (AC:L), and lack of user interaction (UI:N) make exploitation easy once an attacker holds the required low-privilege account (PR:L), but the confidentiality-only impact (C:H/I:N/A:N) caps real-world severity - this is a data-read flaw, not a path to code execution or tampering. EPSS is 1.74% (77th percentile), modest in absolute terms but above median, reflecting moderate predicted exploitation likelihood rather than imminent mass exploitation. The vulnerability is NOT listed in CISA KEV and no public exploit code was identified in the provided data, so there is no evidence of active exploitation. The PR:L requirement is the single most important mitigating factor: an attacker must first authenticate to EPM, which meaningfully narrows the threat to insiders or adversaries who have already obtained credentials. No key signals conflict here; the main realistic concern is that EPM is a high-value endpoint-management platform whose database can hold sensitive asset, credential, and configuration data, so even a read-only SQLi is a worthwhile target. Overall this is a genuine patch-worthy issue but a second-tier priority relative to unauthenticated RCE-class Ivanti bugs.

An attacker who already holds a low-privileged Ivanti Endpoint Manager account (or has phished/reused valid credentials) sends crafted input to a vulnerable EPM endpoint that is concatenated into a backend SQL query. Because the attack is network-based, low-complexity, and needs no user interaction, the attacker can systematically extract arbitrary data from the EPM database, such as managed-device inventory and stored configuration data. No public proof-of-concept exploit was identified at the time of analysis.