This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Ivanti fixes 4 vulnerabilities in its products
Ivanti fixes 4 vulnerabilities in the products Ivanti Neurons for ITSM, Ivanti Cloud Services Application and Ivanti Endpoint Manager Mobile [1][2][3].
An unauthenticated remote attacker can, depending on the system configuration, gain administrator access to the system in Ivanti Neurons for ITSM (on-premise only) [1].
The vulnerability is present in product:
- *:Ivanti Neurons for ITSM; =2023.4; =2024.2; =2024.3
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-22462 at cve.org, NVD
- CWE-288: Authentication Bypass Using an Alternate Path or Channel at cwe.mitre.org
The vulnerability was publicly disclosed 13. 5. 2025.
An authenticated local attacker can elevate their privileges in Ivanti Cloud Services Application [2].
The vulnerability is present in product:
- *:Ivanti Cloud Services Application; <=5.0.4
CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-22460 at cve.org, NVD
- CWE-1392: Use of Default Credentials at cwe.mitre.org
The vulnerability was publicly disclosed 13. 5. 2025.
An unauthenticated remote attacker can, due to an authentication bypass flaw in Ivanti Endpoint Manager Mobile, access protected resources without the appropriate credentials [3].
The vulnerability is present in product:
- *:Ivanti Endpoint Manager Mobile; <=11.12.0.4; <=12.3.0.1; <=12.4.0.1, <=12.5.0.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
More information:
- CVE-2025-4427 at cve.org, NVD
- CWE-288: Authentication Bypass Using an Alternate Path or Channel at cwe.mitre.org
The vulnerability was publicly disclosed 13. 5. 2025.
An authenticated remote attacker can execute arbitrary code in Ivanti Endpoint Manager Mobile [3].
The vulnerability is present in product:
- *:Ivanti Endpoint Manager Mobile; <=11.12.0.4; <=12.3.0.1; <=12.4.0.1, <=12.5.0.0
CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
More information:
- CVE-2025-4428 at cve.org, NVD
- CWE-94: Improper Control of Generation of Code ('Code Injection') at cwe.mitre.org
The vulnerability was publicly disclosed 13. 5. 2025.
Links
- [1] https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Neurons-for-ITSM-on-premises-only-CVE-2025-22462
- [2] https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Cloud-Services-Application-CVE-2025-22460
- [3] https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
By CESNET, z.s.p.o. Michaela Jarošová on 14. 5. 2025.