Pfadüberschreitung in Ivanti Endpoint Manager vor Version 2024 SU4 SR1 ermöglicht es einem Remote-Authentifizierten Angreifer, beliebige Dateien außerhalb des vorgesehenen Verzeichnisses zu schreiben. Benutzerinteraktion ist erforderlich.

The impact of this Path Traversal vulnerability is significant. An attacker who can successfully exploit it can write files to arbitrary locations on the system, bypassing intended security controls. This could allow them to overwrite critical system files, install malware, or gain persistent access to the environment. The requirement for authentication limits the immediate scope, but successful compromise of a single authenticated user could provide a foothold for further attacks. The ability to write arbitrary files represents a serious escalation of privileges and a potential for widespread damage.

Organizations heavily reliant on Ivanti Endpoint Manager for device management and security are at significant risk. Environments with weak authentication controls or where user awareness training is lacking are particularly vulnerable. Shared hosting environments utilizing Ivanti Endpoint Manager should also be considered high-risk due to the potential for cross-tenant exploitation.

• windows / supply-chain:

Get-WinEvent -LogName Security -Filter "EventID = 4663 and SubjectUserName -like '*attacker*'" | sls

• windows / supply-chain:

Get-Process | Where-Object {$_.Path -like "*\ivanti*"} | Select-Object ProcessName, Path

• windows / supply-chain:

Get-ScheduledTask | Where-Object {$_.TaskName -like '*ivanti*'}

1. 2025-12-09Disclosure

   disclosure

1. Reserviert2025-11-25
2. Veröffentlicht2025-12-09
3. Geändert2026-02-26
4. EPSS aktualisiert2026-03-23

The primary mitigation for CVE-2025-13661 is to upgrade to Ivanti Endpoint Manager version 2024 SU4 SR1 or later, which contains the fix. If immediate patching is not possible, consider implementing temporary workarounds. Restrict access to the vulnerable endpoint to only authorized users. Implement strict file access controls to limit the attacker's ability to write to sensitive locations. Monitor system logs for suspicious file creation or modification activity. Consider using a Web Application Firewall (WAF) to filter requests and block attempts to exploit the path traversal vulnerability. After upgrade, confirm the vulnerability is resolved by attempting a path traversal attack and verifying that access is denied.