CVE-2024-13163 Overview
CVE-2024-13163 is a deserialization of untrusted data vulnerability [CWE-502] in Ivanti Endpoint Manager (EPM). The flaw affects EPM versions before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. A remote unauthenticated attacker can achieve code execution when a local user interacts with attacker-supplied content. Ivanti disclosed the issue in its January 2025 security advisory alongside a set of related EPM fixes.
Critical Impact
Successful exploitation grants arbitrary code execution on the affected EPM host, exposing managed endpoints and administrative credentials to compromise.
Affected Products
- Ivanti Endpoint Manager 2024 (before the January-2025 Security Update)
- Ivanti Endpoint Manager 2022 SU1 through SU5
- Ivanti Endpoint Manager 2022 SU6 (before the January-2025 Security Update)
Discovery Timeline
- 2025-01-14 - CVE-2024-13163 published to the National Vulnerability Database
- 2025-01-14 - Ivanti released the EPM January 2025 Security Advisory
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13163
Vulnerability Analysis
The vulnerability stems from unsafe deserialization of attacker-controlled data within Ivanti Endpoint Manager. When the affected component processes a serialized object stream, it reconstructs objects without validating their type or origin. This enables an attacker to embed gadgets that trigger method invocations during deserialization, ultimately executing arbitrary code in the EPM process context.
Exploitation requires local user interaction, indicating that a user on the target host must open, load, or process the crafted payload for the deserialization path to execute. Because EPM manages large fleets of endpoints, code execution on the management server or agent host can pivot to widespread downstream compromise.
The EPSS score is 9.214% with a percentile of 94.858, placing the flaw in the top tier of vulnerabilities by predicted exploitation likelihood despite no confirmed public exploit at the time of publication.
Root Cause
The root cause is the use of an insecure deserialization routine that accepts serialized input without enforcing type allowlists, integrity checks, or signature validation. Deserialization gadget chains within referenced libraries can be leveraged to reach code execution primitives during object reconstruction.
Attack Vector
The attack requires local access and user interaction. A malicious actor delivers a crafted serialized payload to a user, and when the user processes the payload through the vulnerable EPM component, arbitrary code executes with the privileges of the invoking process. Refer to the Ivanti Security Advisory January 2025 for component-level detail.
Detection Methods for CVE-2024-13163
Indicators of Compromise
- Unexpected child processes spawned by Ivanti EPM services or agent binaries
- Serialized object files (.bin, .dat) staged in user-writable directories prior to EPM invocation
- Outbound network connections from EPM processes to unrecognized hosts following user interaction with third-party files
Detection Strategies
- Monitor EPM service accounts for anomalous process creation, particularly cmd.exe, powershell.exe, or scripting hosts as children of EPM binaries
- Alert on EPM processes loading unsigned or unusual .NET assemblies at runtime
- Correlate file-write events for serialized payloads with subsequent EPM component execution
Monitoring Recommendations
- Enable command-line and module-load auditing on EPM management servers and administrator workstations
- Forward EPM application and Windows Security logs to a centralized SIEM for retention and correlation
- Track privileged account usage on EPM hosts and investigate deviations from baseline administrative workflows
How to Mitigate CVE-2024-13163
Immediate Actions Required
- Apply the Ivanti EPM 2024 January-2025 Security Update or EPM 2022 SU6 January-2025 Security Update without delay
- Inventory all EPM installations and confirm patch level against the vendor advisory
- Restrict administrative access to EPM consoles and hosts to a minimal set of privileged users
Patch Information
Ivanti published fixed builds in the Ivanti Security Advisory January 2025. Upgrade to the EPM 2024 January-2025 Security Update or the EPM 2022 SU6 January-2025 Security Update to remediate CVE-2024-13163.
Workarounds
- No vendor-supplied workaround is documented; patching is the required remediation path
- Reduce exposure by limiting local logon rights on EPM servers and enforcing least privilege for accounts that interact with EPM components
- Educate administrators to avoid opening untrusted files or archives on EPM management hosts pending patch deployment
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
