This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ivanti fixes 11 vulnerabilities

Ivanti fixes 11 vulnerabilities in its products. The most severe of them are described below; the remaining ones can be found at [1][2][3]. Individual products and their fixed versions: Ivanti Connect Secure (ICS) [1] - 22.7R2.8 Ivanti Policy Secure (IPS) [1] - 22.7R1.5 Ivanti Endpoint Manager (EPM) [2] - 2024 SU3, 2022 SU8 Security Update 1 Ivanti Endpoint Manager Mobile (EPMM) [3] - 12.5.0.2, 12.4.0.3, 12.3.0.3

Ivanti Endpoint Manager - password disclosure (CVE-2025-6995, CVE-2025-6996)
CVSS 8.4 (High)

An authenticated local attacker is, due to improper use of encryption in the Ivanti EPM agent, allowed to decrypt other users' passwords [2].

The vulnerability is present in product:

  • Ivanti Endpoint Manager; <2022 SU8 Security Update 1; >2022 SU8 Security Update 1, <2024 SU3;

CVSS: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N

More information:

The vulnerability was publicly disclosed 8. 7. 2025.

Ivanti Endpoint Manager Mobile - OS command injection (CVE-2025-6770, CVE-2025-6771)
CVSS 7.2 (High)

An authenticated remote attacker with elevated privileges is, due to an OS command injection vulnerability in Ivanti EPMM, allowed to execute code [3].

The vulnerability is present in product:

  • Ivanti Endpoint Manager Mobile; <12.3.0.3; >12.3.0.3, <12.4.0.3; >12.4.0.3, <12.5.0.2;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-6770 at cve.org, NVD
  • CVE-2025-6771 at cve.org, NVD
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2025.

Ivanti Endpoint Manager - SQL injection (CVE-2025-7037)
CVSS 5.5 (Medium)

An authenticated remote attacker with administrator rights is, due to a SQL injection vulnerability in Ivanti EPM, allowed to read arbitrary data from the database [2].

The vulnerability is present in product:

  • Ivanti Endpoint Manager; <2022 SU8 Security Update 1; >2022 SU8 Security Update 1, <2024 SU3;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

More information:

  • CVE-2025-7037 at cve.org, NVD
  • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') at cwe.mitre.org

The vulnerability was publicly disclosed 8. 7. 2025.

Ivanti Connect Secure & Policy Secure - CRLF injection (CVE-2025-0293)
CVSS 6.6 (Medium)

An authenticated remote attacker with administrator rights is, due to a CRLF injection vulnerability in ICS and IPS, allowed to write to a protected configuration file on disk [1].

The vulnerability is present in products:

  • Ivanti Connect Secure; <22.7R2.8;
  • Ivanti Policy Secure; <22.7R1.5;

CVSS: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:L

More information:

The vulnerability was publicly disclosed 8. 7. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 14. 7. 2025.

CESNET, z.s.p.o. Logo