Ce mail provient de l'extérieur, restons vigilants

=====================================================================

                            CERT-Renater

                Note d'Information No. 2025/VULN431
_____________________________________________________________________

DATE                : 09/07/2025

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S): Systems running Ivanti Endpoint Manager Mobile 
                    versions prior to 12.5.0.2, 12.4.0.3, 12.3.0.3.

=====================================================================
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM-CVE-2025-6770-CVE-2025-6771?language=en_US
_____________________________________________________________________

Security Advisory Ivanti Endpoint Manager Mobile (EPMM)
(CVE-2025-6770, CVE-2025-6771)

Primary Product
Ivanti Endpoint Manager Mobile (Core)

Categories
Security/Vulnerability Issue

Created Date
Jul 8, 2025 2:35:46 PM

Last Modified Date
Jul 8, 2025 2:36:03 PM
 

Security Advisory Ivanti Endpoint Manager Mobile (EPMM) (CVE-2025-6770,
CVE-2025-6771) 


Summary 

Ivanti has released updates for Ivanti Endpoint Manager Mobile which
addresses two high severity vulnerabilities. 

We are not aware of any customers being exploited by these
vulnerabilities at the time of disclosure. 

 
Vulnerability Details: 

CVE Number    Description   CVSS Score (Severity)    CVSS Vector 
CWE 

CVE-2025-6770    OS command injection in Ivanti Endpoint Manager Mobile
(EPMM) before version 12.5.0.2 allows a remote authenticated attacker
with high privileges to achieve remote code execution 
7.2(High) 
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 
CWE-78 

CVE-2025-6771    OS command injection in Ivanti Endpoint Manager Mobile
(EPMM) before version 12.5.0.2 allows a remote authenticated attacker
with high privileges to achieve remote code execution 
7.2(High) 
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H 
CWE-78 
 

Affected Versions 

Product Name    Affected Version(s)    Resolved Version(s) 
Patch Availability 

Ivanti Endpoint Manager
Mobile                   12.5.0.1 and prior 
                         12.4.0.2 and prior   
                         12.3.0.2 and prior    12.5.0.2 
                                               12.4.0.3 
                                               12.3.0.3 
	
Download Portal.  
https://portal.ivanti.com/ 

 
Solution 

These vulnerabilities are resolved on the latest version of
the product and can be accessed in the download portal
(Login Required): 

    Ivanti Endpoint Manager Mobile 12.5.0.2, 12.4.0.3
and 12.3.0.3 

 
Acknowledgements 

Ivanti would like to thank the following for reporting the
relevant issues and for working with Ivanti to help protect
our customers: 

    Piotr Bazydlo (@chudyPB) of watchTowr (CVE-2025-6771) 

Note: Ivanti is dedicated to ensuring the security and
integrity of our enterprise software products. We recognize
the vital role that security researchers, ethical hackers,
and the broader security community play in identifying and
reporting vulnerabilities. Visit HERE to learn more about
our Vulnerability Disclosure Policy. 

 
FAQ 

    Are you aware of any active exploitation of these vulnerabilities? 

We are not aware of any customers being exploited by these
vulnerabilities prior to public disclosure. These
vulnerabilities were disclosed through our responsible
disclosure program.   

    How can I tell if I have been compromised? 
    Currently, there is no known public exploitation of this
vulnerability that could be used to provide a list of
indicators of compromise. 

    What should I do if I need help?  

If you have questions after reviewing this information, you can
log a case and/or request a call via the Success Portal  

 
Article Number :
000100682

Article Promotion Level
Normal


=========================================================
+ CERT-RENATER        |    tel : 01-53-94-20-44         +
+ 23/25 Rue Daviel    |    fax : 01-53-94-20-41         +
+ 75013 Paris         |   email:cert@support.renater.fr +
=========================================================