/Vulnerability Library

Ivanti Endpoint Manager Mobile - Unauthenticated Remote Code Execution

CVE-2025-4427
Verified

Description

An authentication bypass in Ivanti Endpoint Manager Mobile allowing attackers to access protected resources without proper credentials. This leads to unauthenticated Remote Code Execution via unsafe userinput in one of the bean validators which is sink for Server-Side Template Injection.

Severity

Critical

CVSS Score

5.3

Exploit Probability

100%

Affected Product

endpoint_manager_mobile

Published Date

May 15, 2025

Template Author

iamnoooob, rootxharsh, parthmalhotra
+1

CVE-2025-4427.yaml
5.3Score

CVSS Metrics

CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVE ID:
cve-2025-4427
CWE ID:
cwe-288

References

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM

Remediation Steps

Apply the security patches as described in the Ivanti security advisory for Endpoint Manager Mobile.