CVE-2025-13662CWE-347

CVE-2025-13662

High · published December 9, 2025

CVSS v3.1
7.8
EPSS
1%
Percentile
46.7
In the wild
Unconfirmed
What it is

⚡ A single misstep in signature verification can let an attacker waltz right in! This flaw in Ivanti Endpoint Manager before version 2024 SU4 SR1 is like leaving the door wide open for unwelcome guests. 🔥 Think of it like a restaurant that doesn’t check the signature on a delivery order. If the chef trusts any delivery without verifying the source, they might end up with sabotaged ingredients that ruin the whole meal! In this case, an attacker could gain the ability to execute arbitrary code on your system! This means they could potentially compromise sensitive data or launch attacks from within your environment—yikes! It's a wake-up call to tighten those security measures and avoid disaster.

Put simply

Think of it like a restaurant that doesn’t check the signature on a delivery order. If the chef trusts any delivery without verifying the source, they might end up with sabotaged ingredients that ruin the whole meal! The vulnerability stems from improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager. This weakness allows remote unauthenticated attackers to execute code without any valid user credentials, provided user interaction is involved.

What to do

In this case, an attacker could gain the ability to execute arbitrary code on your system! This means they could potentially compromise sensitive data or launch attacks from within your environment—yikes! It's a wake-up call to tighten those security measures and avoid disaster. To secure your environment, update Ivanti Endpoint Manager to version 2024 SU4 SR1 or later immediately. Additionally, educate your users about the importance of verifying the sources of any updates or changes they initiate. Don't leave your doors unlocked! You've got this! Follow these steps, and you'll be back on track to secure your systems in no time. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00576 · 46.7th percentile
Weakness
CWE-347 · Improper Verification of Cryptographic Signature
Published
2025-12-09T21:17Z
Affected products (7)
ProductVersionsFixed in
ivanti/endpoint_manager< 20242024
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
ivanti/endpoint_managerall versions—
References (1)
EPSS history
Timeline
  • 09 DEC 16:05Z
    Improper verification of cryptographic signatures in the patch management component of Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote…
    cvelistv5