Ivanti Endpoint Manager CVE-2025-62392

Exploitation requires valid authenticated access to the Ivanti Endpoint Manager application at a low privilege level (PR:L) and network reachability to the EPM interface; it does not require user interaction or administrative rights. The limiting factor is authentication - an attacker must first possess or obtain legitimate EPM credentials, so exploitation is realistically constrained to insiders, compromised accounts, or environments where the management console is exposed to lower-trust users. Affected deployments are Ivanti Endpoint Manager versions before 2024 SU5 (including 2024, SU1, SU2, SU3, and SU3 Security Release 1); upgrading to 2024 SU5 remediates. The exact vulnerable parameter/feature is not specified in the advisory data provided.

This is a moderate-severity, authenticated SQL injection (CWE-89) in Ivanti Endpoint Manager with a vendor-assigned CVSS 3.1 base score of 6.5 (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N). The signals are internally consistent and point to a real but not top-tier priority: the vector confirms network-reachable, low-complexity exploitation but requires low-level privileges (PR:L), meaning an attacker must already hold authenticated access to the EPM application. Impact is confidentiality-only (C:H, I:N, A:N) - arbitrary database read, not write or service disruption - which caps the raw severity. EPSS is low at 0.82% (56th percentile), indicating no strong evidence of imminent mass exploitation, and the CVE is NOT listed in CISA KEV, with no public POC referenced in the provided data. Taken together, the signals converge rather than conflict: a CVSS vector consistent with the description, low EPSS, and no KEV/POC all suggest this is a credible internal/post-authentication data-exposure risk for Ivanti EPM operators rather than an urgent wormable threat. The main caveat is the authentication requirement - an attacker needs valid EPM credentials, so real-world risk is highest in environments with weak credential hygiene, exposed management interfaces, or where EPM is reachable by lower-trust users. Prioritize patching given Ivanti's history of being heavily targeted, but this specific CVE does not currently warrant emergency out-of-band treatment absent new exploitation evidence.

An attacker with valid but low-privileged credentials to the Ivanti Endpoint Manager web application submits a crafted request to a vulnerable parameter, injecting SQL that is executed against the backend database. Because impact is read-only, the attacker uses this to exfiltrate sensitive data such as managed-device inventories, configuration, or credential material stored in the EPM database. No public exploit identified at time of analysis, so weaponization would currently require independent development.