Updates address ten critical vulnerabilities which if exploited could lead to remote code execution

Summary

Updates address ten critical vulnerabilities which if exploited could lead to remote code execution

Affected platforms

The following platforms are known to be affected:

Threat details

Introduction

Ivanti has released September 2024 security updates addressing sixteen vulnerabilities, including ten rated as critical affecting Endpoint Manager (EPM). Ivanti EPM is an all-in-one solution for managing devices endpoints within a network.

The vulnerability CVE-2024-29847 has a CVSSv3 score of 10.0 and could allow an unauthenticated, remote attacker to achieve remote code execution (RCE) via deserialization of untrusted data in the agent portal.

Nine further vulnerabilities have a CVSSv3 score of 9.1 and could allow a remote, authenticated attacker with admin privileges to achieve remote code execution via unspecified SQL injection.

The updates also address two high severity and four medium severity vulnerabilities. 

Threat updates

Remediation advice

Affected organisations are encouraged to review Security Advisory EPM September 2024 for EPM 2024 and EPM 2022 and apply any relevant security updates.

Definitive source of threat updates

CVE Vulnerabilities

Last edited: 16 September 2024 11:07 am