PT-2025-20920 · Ivanti · Ivanti Endpoint Manager Mobile

Published

2025-05-13

·

Updated

2025-07-17

·

CVE-2025-4427

CVSS v3.1
7.5
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

**Name of the Vulnerable Software and Affected Versions:**

Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and earlier

**Description:**

An authentication bypass vulnerability exists in the API component of Ivanti Endpoint Manager Mobile (EPMM). This flaw allows attackers to access protected resources without proper credentials via the API. Exploitation of this vulnerability has been observed in real-world attacks by the China-linked UNC5221 threat actor, targeting organizations in the defense, healthcare, and finance sectors. These attacks involve the deployment of malware such as KrustyLoader and Sliver. The vulnerability enables unauthenticated Remote Code Execution (RCE). Over 1,400 exposed instances have been identified in the US and Germany.

**Recommendations:**

Ivanti Endpoint Manager Mobile versions prior to 12.5.0.0 should be updated to a fixed version. As a temporary workaround, consider filtering API access to minimize the risk of exploitation.

Fix

RCE

Authentication Bypass Using an Alternate Path or Channel

Code Injection

Weakness Enumeration

CWE-288CWE-94

Related Identifiers

BDU:2025-05712
CVE-2025-4427
GHSA-7V6M-28JR-RG84

Affected Products

Ivanti Endpoint Manager Mobile