PT-2025-17626 · Ivanti · Ivanti Landesk Management Gateway

0Xbytehunter · Published 2025-04-23 · Updated 2025-04-23 · CVE-2025-43716

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti LANDesk Management Gateway versions 4.2-1.9

Description A directory traversal issue exists, allowing an attacker to bypass access controls and gain unauthorized access to various endpoints within the management web panel by appending %3F.php to the URI of the /client/index.php endpoint. This could potentially expose sensitive device information.

Recommendations For versions 4.2-1.9, consider restricting access to the /client/index.php endpoint until a fix is available. As a temporary workaround, avoid using the /client/index.php endpoint with appended parameters like %3F.php to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-180

Related Identifiers

CVE-2025-43716

Affected Products

Ivanti Landesk Management Gateway

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2025-43716 · Security Note
• https://t.me/cvedetector/23595 · Telegram Post
• https://forums.ivanti.com/s/article/Graphical-overview-of-the-LANDesk-Management-Gateway-Functionality · Note
• https://t.me/cvetracker/22198 · Telegram Post
• https://twitter.com/WolfgangSesin/status/1915075118268563468 · Twitter Post
• https://twitter.com/CVEnew/status/1915041138341298664 · Twitter Post
• https://medium.com/@0xbytehunter/discovery-of-path-traversal-vulnerability-in-landesk-management-gateway-devices-6dba386dd290 · Note