Ivanti Endpoint Manager Remote Code Execution Vulnerability Due to Insufficient Filename Validation

A remote code execution vulnerability has been identified in Ivanti Endpoint Manager (EPM) versions prior to the January 2025 Security Update for both the 2024 and 2022 SU6 releases. This vulnerability arises from inadequate validation of filenames, allowing an unauthenticated attacker to execute arbitrary code remotely. Exploitation of this issue requires local user interaction.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected system.

Remediation

Users can download the security hot patch for Ivanti Endpoint Manager 2024 and 2022 SU6 from the Ivanti License System (ILS). After applying the patch, it is recommended to run 'AgentEngineHashUpdate.exe' to update the hash values in the database. For EPM 2024, the patch is cumulative and includes previous security fixes. Users should reboot the core server after applying the patch.