virus logo Intrusion Prevention

Ivanti.EPMM.RSAPIV2.Remote.Code.Execution

description-logoDescription

This indicates an attack attempt to exploit a Remote Code Execution vulnerability in Ivanti Endpoint Manager Mobile (EPMM).
The vulnerability is due to insufficient sanitization of user-supplied input in the application. A remote attacker could exploit this vulnerability to achieve remote code execution in the context of the user running the application.

affected-products-logoAffected Products

Ivanti Endpoint Manager Mobile (EPMM) 12.5.0.0 and prior

Impact logoImpact

System Compromise: Remote attackers can gain control of vulnerable systems.

recomended-action-logoRecommended Actions

Apply the most recent upgrade or patch from the vendor.
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM

Coverage

IPS (Regular DB)
IPS (Extended DB)

Version Updates

Date Version Status Detail
2025-07-15 33.045
Modified
 Sig Added
2025-06-04 33.019
Modified
 Default_action:pass:drop
2025-06-02 33.017
Modified
 Sig Added
2025-05-22 33.012
Modified
 Name:Ivanti.
EPMM.
CVE-2025-4428.
Remote.
Code.
Execution:Ivanti.
EPMM.
RSAPIV2.
Remote.
Code.
Execution
2025-05-21 33.011
New
ID 58055
Created May 20, 2025
Updated Jul 15, 2025
CVE ID
Tags Threat Signal
Risk black-background-circle-icon black-background-circle-icon black-background-circle-icon black-background-circle-icon lightgray-background-circle-icon
Known Exploited Yes
Exploit Prediction Score 91.59%
Default Action drop
Active
Affected OS Linux
Affected App Other
Profile Type Code Injection