Ivanti Endpoint Manager CVE-2025-62391

Requires an authenticated session to Ivanti Endpoint Manager at a low privilege level (PR:L) - the attacker must already possess valid credentials or a foothold account; this authentication requirement is the primary factor limiting exploitation. The flaw affects Ivanti Endpoint Manager builds before 2024 SU5 (including base 2024, SU1, SU2, SU3, and SU3 Security Release 1 per the CPE list). The description names no special feature toggle or non-default configuration, implying the injectable code path is reachable in standard deployments by any authenticated user; impact is limited to reading database data (no write or denial-of-service capability).

This is a moderate-priority, not high-urgency, issue. The CVSS 3.1 base score of 6.5 (Medium) is driven by a network attack vector (AV:N) with low complexity (AC:L) but requires low-privilege authentication (PR:L) and yields confidentiality-only impact (C:H/I:N/A:N) - i.e., an authenticated user can read arbitrary database contents but cannot modify data or disrupt availability. Supporting signals align with a measured rather than emergency response: EPSS is low at 0.82% (56th percentile), there is no CISA KEV listing, and no public proof-of-concept was provided in the intelligence, so this is 'no public exploit identified at time of analysis.' No SSVC decision data was supplied. The signals are internally consistent - the authentication requirement meaningfully constrains the attacker population, and the low EPSS matches the absence of known exploitation - so there is no conflict to flag beyond noting that the authentication precondition (PR:L) is the single most important mitigating factor keeping this out of critical territory.

An attacker who already holds valid low-privilege credentials to the Ivanti Endpoint Manager web application submits crafted input to a vulnerable parameter, injecting SQL that the backend executes against the management database. This lets them exfiltrate sensitive records (managed-device inventory, credentials, or configuration data) beyond their authorization. No public exploit code was identified in the provided data, and the required authentication raises the practical barrier.