CVE-2024-13171: Ivanti Endpoint Manager RCE Vulnerability

CVE-2024-13171 Overview

CVE-2024-13171 is a remote code execution vulnerability in Ivanti Endpoint Manager (EPM) caused by insufficient filename validation. The flaw affects EPM 2024 releases before the January-2025 Security Update and EPM 2022 SU6 before the January-2025 Security Update. A remote unauthenticated attacker can trigger code execution, though local user interaction is required to complete exploitation. The weakness is classified as an unrestricted file upload issue [CWE-434]. Ivanti EPM is widely deployed for endpoint management across enterprise environments, making unpatched instances an attractive target for initial access operations.

Critical Impact
Successful exploitation grants attackers code execution on affected EPM systems, enabling lateral movement, credential theft, and persistent control over managed endpoints.

Affected Products

Ivanti Endpoint Manager 2024 (before January-2025 Security Update)
Ivanti Endpoint Manager 2022 SU1 through SU5
Ivanti Endpoint Manager 2022 SU6 (before January-2025 Security Update)

Discovery Timeline

2025-01-14 - CVE-2024-13171 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-13171

Vulnerability Analysis

CVE-2024-13171 stems from improper validation of filenames processed by Ivanti Endpoint Manager. The flaw falls under CWE-434, Unrestricted Upload of File with Dangerous Type. An attacker can supply crafted filenames that bypass validation logic, resulting in files being written or executed in security-sensitive contexts.

Although the attack vector is local at execution time, the vulnerability advisory notes that a remote unauthenticated attacker can initiate exploitation. The path to code execution requires interaction by a local user, such as opening a file or triggering a workflow within the EPM console.

The EPSS probability of 17.6% places this vulnerability in the 96th percentile, indicating elevated likelihood of exploitation activity compared to typical CVEs. Endpoint management platforms are prized targets because they provide administrative reach across large fleets of managed systems.

Root Cause

The root cause is insufficient filename validation within EPM's file-handling routines. The affected code paths accept filenames without enforcing extension whitelists, MIME-type checks, or path canonicalization sufficient to prevent dangerous file types from being processed. When a crafted filename is combined with the required user interaction, the resulting file is treated in a way that leads to arbitrary code execution.

Attack Vector

Exploitation requires an attacker to deliver a crafted file or filename to the EPM environment. A local user must then interact with the file, such as through a management workflow or console-driven action. Once the interaction occurs, EPM processes the file in a manner that executes attacker-controlled logic in the context of the EPM service or user session. See the Ivanti Security Advisory January 2025 for vendor-supplied technical context. No public proof-of-concept exploit code has been released at the time of publication.

Detection Methods for CVE-2024-13171

Indicators of Compromise

Unexpected files with executable or script extensions appearing in EPM upload, staging, or content directories on the management server.
Child processes spawned by EPM service accounts (LANDesk, Ivanti.EPM) that execute shells, scripting hosts, or LOLBins such as powershell.exe, cmd.exe, wscript.exe, or regsvr32.exe.
Outbound network connections from the EPM server to unfamiliar external hosts shortly after file interactions in the console.
New scheduled tasks, services, or registry Run keys created on the EPM server following administrator activity.

Detection Strategies

Hunt for anomalous process ancestry where EPM binaries launch interpreters or unsigned executables.
Correlate EPM console user activity with file-write events targeting sensitive directories used by the management platform.
Alert on newly written files with double extensions, unusual Unicode characters, or extensions that mismatch declared content types.

Monitoring Recommendations

Enable verbose file audit logging on EPM installation and content directories and forward events to a central analytics platform.
Track authentication and administrative actions against the EPM console, prioritizing off-hours or first-time-seen accounts.
Baseline outbound traffic from EPM servers and alert on deviations to internet destinations.

How to Mitigate CVE-2024-13171

Immediate Actions Required

Apply the Ivanti EPM January-2025 Security Update for EPM 2024 or the January-2025 Security Update for EPM 2022 SU6.
Inventory all EPM servers and confirm build versions match a patched release.
Restrict network access to EPM management interfaces to trusted administrative networks and jump hosts.
Review recent EPM console activity and file uploads for signs of prior exploitation attempts.

Patch Information

Ivanti released fixes in the January 2025 security update cycle. Administrators should upgrade to EPM 2024 January-2025 Security Update or EPM 2022 SU6 January-2025 Security Update. Full patch details and download links are available in the Ivanti Security Advisory January 2025.

Workarounds

Limit EPM console access to a small set of vetted administrators until patching is complete.
Enforce endpoint protection policies on the EPM server to block execution of scripting hosts spawned by management services.
Segment EPM servers on isolated management VLANs with strict egress filtering to reduce blast radius if exploitation occurs.

bash

# Verify installed Ivanti EPM build on Windows management server
reg query "HKLM\SOFTWARE\LANDesk\ManagementSuite\Setup" /v Version

# Restrict inbound access to EPM management ports to a trusted admin subnet
New-NetFirewallRule -DisplayName "EPM-Admin-Only" -Direction Inbound `
  -Protocol TCP -LocalPort 443,9982,9595 `
  -RemoteAddress 10.10.20.0/24 -Action Allow