CVE-2024-13170: Ivanti Endpoint Manager DOS Vulnerability

CVE-2024-13170 Overview

CVE-2024-13170 is an out-of-bounds write vulnerability [CWE-787] in Ivanti Endpoint Manager (EPM). The flaw affects EPM 2024 releases prior to the January-2025 Security Update and EPM 2022 SU6 prior to the January-2025 Security Update. A remote, unauthenticated attacker can exploit the issue over the network to trigger a denial of service condition on the affected service.

Ivanti disclosed the vulnerability in its Ivanti Security Advisory January 2025. No public proof-of-concept or in-the-wild exploitation has been confirmed, and the CVE is not currently listed on the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Remote unauthenticated attackers can crash or destabilize Ivanti EPM services, disrupting endpoint management across the enterprise.

Affected Products

Ivanti Endpoint Manager 2024 (prior to the January-2025 Security Update)
Ivanti Endpoint Manager 2022 SU1 through SU5
Ivanti Endpoint Manager 2022 SU6 (prior to the January-2025 Security Update)

Discovery Timeline

2025-01-14 - CVE-2024-13170 published to NVD alongside Ivanti's January 2025 EPM security advisory
2025-07-11 - Last updated in NVD database

Technical Details for CVE-2024-13170

Vulnerability Analysis

The vulnerability is an out-of-bounds write in Ivanti Endpoint Manager, classified under [CWE-787]. Out-of-bounds writes occur when software writes data past the end, or before the beginning, of an intended memory buffer. In this instance the condition is reachable remotely without authentication, meaning an attacker only needs network access to the EPM service to trigger the flaw.

The documented impact is limited to availability. Successful exploitation causes the targeted EPM component to enter an unstable state, terminating the process or rendering the service unresponsive. Confidentiality and integrity are not affected, indicating the corrupted memory region does not yield attacker-controlled code execution in known exploitation paths.

For enterprises that rely on EPM for patching, software distribution, and endpoint inventory, loss of availability cascades into delayed patch deployment and reduced visibility into managed assets.

Root Cause

The root cause is improper validation of size or boundary information before writing data into a buffer within an EPM service that processes network-supplied input. When malformed or oversized data is supplied, the write operation overruns the allocated buffer, corrupting adjacent memory and causing the service to terminate abnormally.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker with reachability to a vulnerable Ivanti EPM server sends a crafted request to the exposed service. The malformed payload triggers the out-of-bounds write, producing a denial of service. No public proof-of-concept code has been released, and Ivanti has not published detailed exploitation specifics in its advisory.

Detection Methods for CVE-2024-13170

Indicators of Compromise

Unexpected crashes, restarts, or hangs of Ivanti EPM services on management servers
Windows Application or System event log entries showing access violations or faulting modules tied to EPM processes
Anomalous inbound network traffic to EPM listener ports from untrusted sources, particularly malformed or oversized requests
Gaps in EPM agent check-ins coinciding with service instability on the management server

Detection Strategies

Inventory all Ivanti EPM installations and compare installed build numbers against the fixed releases listed in the January 2025 advisory
Monitor process and service health for EPM components; repeated unexpected terminations warrant investigation
Inspect network traffic to EPM management ports for malformed protocol messages or unusual request sizes from unauthenticated sources

Monitoring Recommendations

Forward EPM application logs and Windows event logs to a centralized SIEM or data lake for correlation
Alert on EPM service restart events and process crash dumps generated on the EPM server
Track external scanning or repeated connection attempts to EPM-exposed ports from outside the management network

How to Mitigate CVE-2024-13170

Immediate Actions Required

Apply the Ivanti EPM January-2025 Security Update for EPM 2024 or the January-2025 Security Update for EPM 2022 SU6 as outlined in the vendor advisory
Restrict network access to EPM management services so only authorized administrative networks can reach the listener ports
Verify EPM server backups and snapshots are current before patching to enable rapid recovery if service issues occur

Patch Information

Ivanti has released fixed versions in the Ivanti Security Advisory January 2025. Administrators must upgrade EPM 2024 to the January-2025 Security Update level and EPM 2022 SU6 to its January-2025 Security Update level. Earlier EPM 2022 service updates (SU1 through SU5) must be upgraded to 2022 SU6 with the January-2025 Security Update.

Workarounds

Place EPM management servers behind a firewall or VPN that restricts access to administrative subnets only
Apply network segmentation to prevent direct exposure of EPM services to untrusted networks or the internet
Increase monitoring of EPM service availability until patches are deployed across all affected systems

bash

# Example: restrict access to EPM service ports to a trusted management subnet (Windows netsh)
netsh advfirewall firewall add rule name="Restrict-Ivanti-EPM" ^
  dir=in action=block protocol=TCP localport=<EPM_PORT> ^
  remoteip=any

netsh advfirewall firewall add rule name="Allow-Ivanti-EPM-Mgmt" ^
  dir=in action=allow protocol=TCP localport=<EPM_PORT> ^
  remoteip=10.0.0.0/24