Ivanti Endpoint Manager RCE Vulnerabilities Let Attackers Gain Server Access

Ivanti has issued security updates for its Endpoint Manager (EPM) 2024 and 2022 SU6 versions, addressing several critical and high-severity vulnerabilities that could lead to unauthorized access to the EPM core server.

Ivanti Endpoint Manager (formerly known as LANDesk) is a comprehensive system management solution designed to help organizations manage, secure, and optimize their IT infrastructure.

It provides tools for managing endpoints such as desktops, laptops, servers, and mobile devices, whether they are in the office or remote.

The vulnerabilities affect the following versions of Ivanti Endpoint Manager:

• Ivanti Endpoint Manager 2024: Requires both the July and September security patches.
• Ivanti Endpoint Manager 2022 SU5 and earlier: Users are advised to upgrade to 2022 SU6.

Key Vulnerabilities:

1. CVE-2024-37397: An External XML Entity (XXE) vulnerability in the provisioning web service. This flaw could allow remote unauthenticated attackers to leak API secrets.

1. CVE-2024-8191: A SQL injection vulnerability in the management console. Exploitation could lead to remote code execution.

1. Multiple SQL Injection Flaws: Several critical SQL injection vulnerabilities (CVE-2024-32840 through CVE-2024-34785) allow remote authenticated attackers with admin privileges to achieve remote code execution.

1. CVE-2024-8320 & CVE-2024-8321: Missing authentication vulnerabilities in Network Isolation, potentially allowing unauthorized attackers to spoof device status or isolate devices from the network.

1. CVE-2024-29847: A critical deserialization of untrusted data vulnerability in the agent portal, which could allow remote unauthenticated attackers to execute code.

Simulating Cyberattack Scenarios With All-in-One Cybersecurity Platform – Watch Free Webinar

Patch The Vulnerabilities

For EPM 2024, users can apply a security hot patch, provided they have installed the July 2024 patch. The necessary files, such as LANDesk.AlertManager.Business.dll and PatchBiz.dll, can be deployed using PowerShell. A reboot is required post-installation. EPM 2022 users are advised to apply SU6 for full protection.

To download the Security Hot Patch files for Ivanti Endpoint Manager (EPM) Patch Tuesday – September 2024, follow these steps. After downloading, the resulting .zip file should contain the following items:

Ivanti has confirmed that, as of the date of disclosure, no active exploitation of these vulnerabilities has been detected. The vulnerabilities were reported via responsible disclosure and no known indicators of compromise have been provided.