An insufficient authorization vulnerability in web component of EPMM prior to 12.1.0.1 allows an unauthorized attacker within the network to execute arbitrary commands on the underlying operating system of the appliance.
The vulnerability consists of insufficient authorization verification in the EPMM web component. An attacker operating within the network can send requests to the vulnerable component without needing to possess any credentials. As a result of this vulnerability, it is possible to execute arbitrary commands directly on the device's operating system.
An attacker can execute arbitrary commands on the appliance operating system, which in practice means complete takeover of the device, possibility of data theft, configuration modification, or further movement within the organization's network.
Ivanti EPMM should be updated to version 12.1.0.1 or newer. Detailed information regarding the update is available in the official Ivanti Security Advisory (Security Advisory — July 2024).
Ivanti Endpoint Manager Mobile (EPMM) in versions prior to 12.1.0.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HIvanti Endpoint Manager Mobile
APPIvanti< 12.1.0.1
Related vulnerabilities
Krytyczny code injection w Ivanti Endpoint Manager Mobile (RCE bez uwierzytelnienia)
Code injection w Ivanti EPMM umożliwiający nieuwierzytelniony RCE
Pominięcie uwierzytelnienia w Ivanti EPMM (MobileIron Core) — dostęp do API
Ivanti EPMM — Authentication Bypass w zdalnym dostępie do API
Nieautoryzowany dostęp do poufnych danych w Ivanti EPMM (CVE-2023-39337)