Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Ivanti EPM Denial of Service from Remote Attack

CVE-2024-13166 · published 1 year ago
Summary

An outdated version of Ivanti EPM is vulnerable to a remote attack that can shut down the system. This means an attacker could prevent users from accessing the service, disrupting business operations. Update to the latest version to protect against this vulnerability.

What to do
  • Update ivanti endpoint_manager to version 2022 or later.
Affected software
VendorProductAffected versions
ivanti endpoint_manager < 2022
2022
2024
cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*
Original advisory text
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
7.5 High
Exploitation
3% chance of attack within 30 days
Type
CWE-787Out-of-bounds Write
Timeline
Published14 Jan 2025
Updated29 Oct 2026
First seen7 Mar 2026
Sources
CVE-2024-13166 · NVD
CVE-2024-13166 · OSV
Track software like this
Free during beta