CVE-2024-13172 Overview
CVE-2024-13172 is an improper signature verification vulnerability [CWE-347] in Ivanti Endpoint Manager (EPM). The flaw affects EPM 2024 releases prior to the January-2025 Security Update and EPM 2022 SU6 prior to the January-2025 Security Update. A remote unauthenticated attacker can leverage the weakness to achieve remote code execution, though successful exploitation requires local user interaction. Ivanti published the coordinated security advisory in January 2025 alongside the corresponding patches.
Critical Impact
A remote unauthenticated attacker who tricks a local user into interacting with a crafted payload can execute arbitrary code on the affected Ivanti EPM host, compromising confidentiality, integrity, and availability of the endpoint management environment.
Affected Products
- Ivanti Endpoint Manager 2024 (prior to the January-2025 Security Update)
- Ivanti Endpoint Manager 2022 SU1 through SU5
- Ivanti Endpoint Manager 2022 SU6 (prior to the January-2025 Security Update)
Discovery Timeline
- 2025-01-14 - CVE-2024-13172 published to the National Vulnerability Database
- January 2025 - Ivanti releases the EPM January-2025 Security Update for EPM 2024 and EPM 2022 SU6
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-13172
Vulnerability Analysis
The vulnerability stems from improper signature verification within Ivanti Endpoint Manager. When EPM processes signed content, it fails to correctly validate cryptographic signatures before acting on the data. This allows an attacker to substitute or forge content that EPM subsequently trusts and executes. The condition is classified under [CWE-347] Improper Verification of Cryptographic Signature.
Exploitation delivers arbitrary code execution on the affected host. Because EPM is an enterprise endpoint management product, code execution in its context provides adversaries with a strong pivot point into managed endpoints across an organization.
Root Cause
The root cause is a logic flaw in the signature verification routine used by EPM to authenticate signed inputs. Rather than rejecting content with invalid or absent signatures, the affected code paths accept attacker-controlled payloads. The Ivanti January-2025 Security Update revises the signature verification logic to close the gap.
Attack Vector
A remote unauthenticated attacker crafts a payload that abuses the signature verification weakness. Exploitation requires a local user on the target system to perform an action such as opening a file or triggering an EPM workflow that consumes the malicious content. Once the payload is processed, the attacker gains code execution in the EPM context. See the Ivanti Security Advisory January 2025 for vendor guidance.
No public proof-of-concept exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.
Detection Methods for CVE-2024-13172
Indicators of Compromise
- Unexpected child processes spawned by Ivanti EPM services or agent binaries on managed servers and endpoints.
- EPM log entries showing content processed without a valid signature or with signature verification warnings.
- New or modified files in EPM installation directories that were not deployed through authorized change control.
- Outbound network connections from EPM host processes to unfamiliar external destinations.
Detection Strategies
- Monitor process lineage for the EPM core service and agent processes, alerting on the execution of scripting engines (powershell.exe, cmd.exe, wscript.exe) as their children.
- Correlate EPM application logs with endpoint telemetry to identify signature verification anomalies preceding code execution events.
- Baseline expected EPM software distribution activity and flag deviations that resemble the delivery of unauthorized payloads.
Monitoring Recommendations
- Ingest Ivanti EPM server and agent logs into a centralized SIEM for continuous review.
- Enable file integrity monitoring on EPM installation directories and configuration files.
- Track authentication and administrative actions against the EPM console to detect follow-on lateral movement.
How to Mitigate CVE-2024-13172
Immediate Actions Required
- Apply the Ivanti EPM January-2025 Security Update to EPM 2024 and EPM 2022 SU6 without delay.
- Inventory all EPM servers and agents to confirm patch coverage across the environment.
- Restrict network access to EPM management interfaces to trusted administrative networks only.
- Educate operators about the local user interaction requirement so suspicious files or prompts are reported rather than opened.
Patch Information
Ivanti addresses CVE-2024-13172 in the January-2025 Security Update for Ivanti Endpoint Manager 2024 and Ivanti Endpoint Manager 2022 SU6. Full remediation details and download links are available in the Ivanti Security Advisory January 2025.
Workarounds
- No vendor-provided workaround exists; patching is the required remediation path.
- Reduce exposure by segmenting EPM infrastructure and enforcing least-privilege access for accounts that interact with EPM.
- Increase endpoint detection sensitivity around EPM host processes until the patch is deployed and verified.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
