PT-2025-20920 · Ivanti · Ivanti Endpoint Manager Mobile

Published 2025-05-13 · Updated 2026-01-06 · CVE-2025-4427

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior

Description An authentication bypass exists in the API component of Ivanti Endpoint Manager Mobile. This allows attackers to access protected resources without proper credentials via the API. This issue is actively exploited, with reports of attackers using it to install malicious software, including Linux cryptominers, and to gain full control of servers. Chinese-linked threat actors (UNC5221) have been observed exploiting this flaw, targeting organizations in the healthcare, government, and finance sectors. The exploitation involves the use of modified variants of the flaw and the deployment of malware such as KrustyLoader and Sliver. The vulnerability enables unauthenticated remote code execution.

Recommendations Apply the latest security updates for Ivanti Endpoint Manager Mobile versions 12.5.0.0 and prior.

Fix

RCE

Code Injection

Authentication Bypass Using an Alternate Path or Channel

Weakness Enumeration

CWE-94

CWE-288

Related Identifiers

BDU:2025-05712

CVE-2025-4427

GHSA-7V6M-28JR-RG84

RHSA-2025:10924

RHSA-2025:10925

RHSA-2025:10926

Affected Products

Ivanti Endpoint Manager Mobile

References · 231

• https://osv.dev/vulnerability/CVE-2025-4427 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-05712 · Security Note
• https://cve.org/CVERecord?id=CVE-2020-5245 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-4427 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-35036 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-4428 · Security Note
• https://osv.dev/vulnerability/GHSA-7v6m-28jr-rg84 · Vendor Advisory
• https://github.com/hibernate/hibernate-validator/pull/1138 · Note
• https://github.com/hibernate/hibernate-validator/compare/6.1.7.Final...6.2.0.Final · Note
• https://github.com/hibernate/hibernate-validator/commit/254858d9dcc4e7cd775d1b0f47f482218077c5e1 · Note
• https://github.com/hibernate/hibernate-validator/commit/d2db40b9e7d22c7a0b44d7665242dfc7b4d14d78 · Note
• https://github.com/hibernate/hibernate-validator/commit/e076293b0ee1bfa97b6e67d05ad9eee1ad77e893 · Note
• https://github.com/hibernate/hibernate-validator/commit/05f795bb7cf18856004f40e5042709e550ed0d6e · Note
• https://github.com/hibernate/hibernate-validator · Note
• https://t.me/pentestingnews/68387 · Telegram Post