Endpoint Manager CVE-2025-6995

|

EUVD

EUVD-2025-20517 HIGH

Storing Passwords in a Recoverable Format (CWE-257)

2025-07-08 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Information Disclosure Ivanti Endpoint Manager

8.4

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

8.4 HIGH

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

None

Lifecycle Timeline

3

EUVD ID Assigned

Mar 16, 2026 - 04:21 euvd

EUVD-2025-20517

Analysis Generated

Mar 16, 2026 - 04:21 vuln.today

CVE Published

Jul 08, 2025 - 15:15 nvd

HIGH 8.4

DescriptionCVE.org

Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.

AnalysisAI

A security vulnerability in the agent of Ivanti Endpoint Manager (CVSS 8.4) that allows a local authenticated attacker. High severity vulnerability requiring prompt remediation.

Technical ContextAI

Vulnerability type not specified by vendor. CVSS 8.4 indicates high severity. Affects the agent of Ivanti Endpoint Manager.

RemediationAI

Monitor vendor channels for patch availability.

More in Endpoint Manager

View all

CVE-2024-13159 CRITICAL Emergency POC

Ivanti Endpoint Manager contains an absolute path traversal vulnerability allowing unauthenticated remote attackers to l

CVE-2024-13160 CRITICAL Emergency POC

Ivanti Endpoint Manager contains a second absolute path traversal vulnerability for unauthenticated information disclosu

CVE-2024-13161 CRITICAL Emergency POC

Ivanti Endpoint Manager contains a third absolute path traversal vulnerability for unauthenticated information disclosur

CVE-2026-1603 HIGH Act Now POC

Ivanti Endpoint Manager before 2024 SU5 contains an authentication bypass (CVE-2026-1603, CVSS 8.6) that allows unauthen

CVE-2023-28324 CRITICAL Emergency POC

A improper input validation vulnerability exists in Ivanti Endpoint Manager 2022 and below that could allow privilege es

CVE-2024-29824 HIGH Act Now POC

An unspecified SQL Injection vulnerability in Core server of Ivanti EPM 2022 SU5 and prior allows an unauthenticated att

CVE-2020-13769 HIGH This Week POC

LDMS/alert_log.aspx in Ivanti Endpoint Manager through 2020.1 allows SQL Injection via a /remotecontrolauth/api/device r

CVE-2020-13774 CRITICAL Act Now

An unrestricted file-upload issue in EditLaunchPadDialog.aspx in Ivanti Endpoint Manager 2019.1 and 2020.1 allows an aut

CVE-2024-50330 CRITICAL Act Now

SQL injection in Ivanti Endpoint Manager before 2024 November Security Update or 2022 SU6 November Security Update allow

CVE-2024-29847 CRITICAL Act Now

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows

CVE-2024-8191 CRITICAL Act Now

SQL injection in the management console of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unau

CVE-2023-35084 CRITICAL Act Now

Unsafe Deserialization of User Input could lead to Execution of Unauthorized Operations in Ivanti Endpoint Manager 2022

Same weakness CWE-257 – Storing Passwords in a Recoverable Format

View all

CVE-2026-20128 HIGH POC

CVE-2021-35050 HIGH POC

CVE-2025-57789 MEDIUM POC

CVE-2019-1010241 MEDIUM POC

CVE-2025-8095 CRITICAL

CVE-2025-8904 CRITICAL

CVE-2016-15058 HIGH

CVE-2025-6996 HIGH

Same technique Information Disclosure

View all

CVE-2013-2251 CRITICAL POC

CVE-2017-5638 CRITICAL POC

CVE-2025-24813 CRITICAL POC

CVE-2015-1701 HIGH POC

CVE-2017-0147 HIGH POC

CVE-2014-6324 HIGH POC

CVE-2023-7028 CRITICAL POC

CVE-2017-0213 HIGH POC

Share

CVE-2025-6995 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy