Full Report
The US Cybersecurity and Infrastructure Security Agency (CISA) has added five new flaws in Ivanti and VeraCore products to its Known Exploited Vulnerabilities catalog
Analysis Summary
# Vulnerability: Critical Path Traversal & Other Exploited Flaws in Ivanti and VeraCode Products
## CVE Details
- CVE ID: CVE-2024-13159, CVE-2024-13160, CVE-2024-13161 (Ivanti); CVE-2024-57968, CVE-2025-25181 (VeraCode)
- CVSS Score: CVE-2024-13159/160/161: 9.8 (Critical); CVE-2024-57968: 9.9 (Critical); CVE-2025-25181: 5.8 (Medium)
- CWE: Path Traversal (for Ivanti flaws); Unrestricted File Upload (CVE-2024-57968); SQL Injection (CVE-2025-25181)
## Affected Systems
- Products:
- Ivanti Endpoint Manager (EPM) (for CVE-2024-13159, 13160, 13161)
- Advantive VeraCore (for CVE-2024-57968, 25181)
- Versions: *Specific vulnerable versions were not detailed in the summary, but organizations are urged to patch.*
- Configurations: N/A (Path Traversal/File Upload/SQLi often apply generally based on product presence).
## Vulnerability Description
CISA added **three critical path traversal vulnerabilities** (CVE-2024-13159, CVE-2024-13160, CVE-2024-13161) affecting **Ivanti Endpoint Manager (EPM)**. These flaws allow a remote, unauthenticated attacker to leak sensitive information via absolute path traversal.
Additionally, two flaws affecting **Advantive VeraCore** were added to KEV:
1. **CVE-2024-57968 (Critical, CVSS 9.9):** An unrestricted file upload vulnerability enabling remote attackers to upload files to unintended, potentially web-accessible folders.
2. **CVE-2025-25181 (Medium, CVSS 5.8):** An SQL Injection vulnerability allowing remote attackers to execute arbitrary SQL commands via the `PmSess1` parameter.
## Exploitation
- Status: **Exploited in the wild** (All five CVEs mentioned affecting Ivanti/VeraCode were added to the CISA KEV catalog, indicating observed exploitation).
- Complexity: Low (for path traversal/unrestricted upload, although complexity is not explicitly scored, the nature of these common flaws suggests low barrier to entry).
- Attack Vector: Remote (Network access required).
## Impact
- Confidentiality: High (Path traversal directly leads to information disclosure; File upload can often lead to further compromise).
- Integrity: High (SQL Injection allows arbitrary command execution; Successful file upload can lead to code execution).
- Availability: Medium (Impact varies based on the specific exploit chain utilized).
## Remediation
### Patches
*Specific patch versions for the Ivanti EPM/VeraCode vulnerabilities were not provided in the source material, but an urgent patching mandate is in place.*
- **Action Required:** Organizations must apply the relevant patches released by Ivanti and VeraCode addressing CVE-2024-13159, CVE-2024-13160, CVE-2024-13161, CVE-2024-57968, and CVE-2025-25181 immediately.
### Workarounds
- The primary directive from CISA is immediate remediation (patching). No specific workarounds were detailed for these flaws in this summary.
## Detection
- **Indicators of Compromise (IoCs):** Not explicitly listed, but monitoring for unusual file uploads or unexpected file system activity in web-accessible paths (for VeraCode) or attempts to specify absolute paths in application inputs (for Ivanti EPM) should be prioritized.
- **Detection Methods and Tools:** Utilize network traffic analysis and endpoint detection tools to look for patterns associated with known exploitation techniques for Path Traversal, File Uploads, and SQL Injection targeting the affected Ivanti and VeraCode products. (Note: CISA mentioned that existing detection tools might be insufficient for previously disclosed Ivanti flaws).
## References
- Vendor Advisories: Ivanti/VeraCode security advisories (Search vendor sites for specific patch details related to the CVEs listed).
- Relevant links:
- CISA KEV Catalog update announcement via Infosecurity Magazine (defanged): hXXps://www.infosecurity-magazine.com/news/cisa-kev-ivanti-critical/
- Ivanti prior exploitation involving Connect Secure: hXXps://www.infosecurity-magazine.com/news/critical-ivanti-zeroday-exploited/