Ivanti Security Updates – 15 January 2025

The addressed vulnerabilities could allow the attacker to escalate elevated privileges, perform denial of service attacks, bypass security restrictions, obtain sensitive information, or execute arbitrary code and gain access to the affected systems.

Sample of the addressed vulnerabilities:

1. Ivanti EPM Path Traversal Vulnerability (CVE-2024-10811):

• CVSS: 9.8
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Consequences: Obtain Information

2. Ivanti EPM Privilege Escalation Vulnerability (CVE-2024-13164):

• CVSS: 7.8
• Attack Vector: Local
• Attack Complexity: Low
• Privileges Required: Low
• User Interaction: None
• Consequences: Privilege Escalation

The affected products:

• Ivanti Endpoint Manager (EPM).
• Ivanti Application Control.
• Ivanti Avalanche.
• Ivanti Security Controls.
• Ivanti Neurons for App Control.