Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.
The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Endpoint_manager | Ivanti | * | 2022 (excluding) |
| Endpoint_manager | Ivanti | 2022 (including) | 2022 (including) |
| Endpoint_manager | Ivanti | 2022-su1 (including) | 2022-su1 (including) |
| Endpoint_manager | Ivanti | 2022-su2 (including) | 2022-su2 (including) |
| Endpoint_manager | Ivanti | 2022-su3 (including) | 2022-su3 (including) |
| Endpoint_manager | Ivanti | 2022-su4 (including) | 2022-su4 (including) |
| Endpoint_manager | Ivanti | 2022-su5 (including) | 2022-su5 (including) |
| Endpoint_manager | Ivanti | 2024 (including) | 2024 (including) |