PT-2024-19174 · Ivanti · Ivanti Epm

Published 2024-05-29 · Updated 2025-06-20 · CVE-2024-22058

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Ivanti EPM versions 2021.1 and older

Description A buffer overflow issue allows a low-privilege user on the local machine with the EPM Agent installed to execute arbitrary code with elevated permissions.

Recommendations For Ivanti EPM versions 2021.1 and older, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Heap Based Buffer Overflow

Weakness Enumeration

CWE-122

Related Identifiers

CVE-2024-22058

Affected Products

Ivanti Epm

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2024-22058 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22058 · Vendor Advisory
• https://t.me/rnetsec/20422 · Telegram Post
• https://t.me/defcon_news/123737 · Telegram Post
• https://t.me/secharvester/16306 · Telegram Post
• https://t.me/cvenotify/126293 · Telegram Post
• https://forums.ivanti.com/s/article/CVE-2024-22058-Privilege-Escalation-for-Ivanti-Endpoint-Manager-EPM · Note