WID-SEC-2025-1494 — Ivanti Endpoint Manager Mobile: Mehrere Schwachstellen ermöglichen Codeausführung

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in Ivanti Endpoint Manager Mobile ausnutzen, um beliebigen Programmcode auszuführen.

Product

Ivanti Endpoint Manager Mobile ist eine mobile Verwaltungssoftware zur Verwaltung von Richtlinien für mobile Geräte, Anwendungen und Inhalte.

Vulnerabilities 2

High 7.2

CVE-2025-6770 EPSS 20%

OS command injection in Ivanti Endpoint Manager

OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution

ivanti Endpoint Manager Mobile Network devices

Jul 8, 2025
High 7.2

CVE-2025-6771 EPSS 23%

OS command injection in Ivanti Endpoint Manager

OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2,12.4.0.3 and 12.3.0.3 allows a remote authenticated attacker with high privileges to achieve remote code execution

ivanti Endpoint Manager Mobile Network devices

Jul 8, 2025

Revision history

2025-07-08 #1
Initiale Fassung

References

Ivanti Security Advisory - Endpoint Manager Mobile vom 2025-07-08
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2025-6770-CVE-2025-6771?language=en_US