CVE-2025-10573: Ivanti Endpoint Manager XSS Vulnerability

CVE-2025-10573 Overview

CVE-2025-10573 is a stored cross-site scripting (XSS) vulnerability in Ivanti Endpoint Manager versions prior to 2024 SU4 SR1. A remote, unauthenticated attacker can inject malicious JavaScript that executes in the context of an administrator session when the administrator views the affected component. Successful exploitation requires user interaction. The flaw is tracked under [CWE-79] (Improper Neutralization of Input During Web Page Generation) and is addressed in the Ivanti Security Advisory December 2025.

Critical Impact
An unauthenticated attacker can execute arbitrary JavaScript within an administrator's authenticated session, enabling session abuse, configuration tampering, and potential lateral movement across managed endpoints.

Affected Products

Ivanti Endpoint Manager 2024 (GA, SU1, SU2, SU3, SU3 Security Release 1, SU4)
Ivanti Endpoint Manager versions prior to 2024 SU4 SR1
All earlier 2024 service updates remain vulnerable until SR1 is applied

Discovery Timeline

2025-12-09 - CVE-2025-10573 published to NVD
2025-12-11 - Last updated in NVD database

Technical Details for CVE-2025-10573

Vulnerability Analysis

The vulnerability is a stored XSS issue in the Ivanti Endpoint Manager web interface. The application fails to properly neutralize attacker-supplied input before storing it and later rendering it in administrator-facing pages. When an administrator loads the affected view, the injected payload executes within the trusted origin of the management console.

Because the injection point is reachable without authentication, an external attacker can plant the payload and wait for an administrator to trigger execution. The scope is changed (S:C in the CVSS vector), meaning code running in the browser can affect resources beyond the vulnerable component, including administrative API calls authorized by the active session.

Root Cause

The root cause is improper neutralization of input during web page generation [CWE-79]. Untrusted data submitted through an unauthenticated entry point is persisted by the server and later returned to administrative users without sufficient output encoding or content security policy enforcement.

Attack Vector

An unauthenticated attacker submits a crafted request containing JavaScript to a vulnerable endpoint on the Ivanti Endpoint Manager server. The payload is stored server-side. When an administrator subsequently navigates to a page that renders the stored data, the browser executes the script in the administrator's session context. The attacker can then issue authenticated requests to the management console, exfiltrate session tokens, modify policies, or push actions to managed endpoints.

No verified proof-of-concept code is publicly available. Refer to the Ivanti Security Advisory December 2025 for vendor technical details.

Detection Methods for CVE-2025-10573

Indicators of Compromise

Unexpected HTML or JavaScript tags (<script>, onerror=, onload=) in fields rendered by the EPM administrative console.
Outbound requests from administrator browsers to unfamiliar domains shortly after loading EPM pages.
New or modified administrative accounts, policies, or scheduled tasks that cannot be tied to a known change.
Anomalous API calls originating from administrator sessions to EPM endpoints during normal browsing activity.

Detection Strategies

Inspect web server and application logs for unauthenticated POST or PUT requests containing script-like content targeting EPM input endpoints.
Review browser session telemetry for script execution events originating from EPM hostnames.
Correlate administrator login times with subsequent privileged actions to identify automation indicative of XSS-driven activity.

Monitoring Recommendations

Enable verbose logging on the EPM web tier and forward logs to a centralized SIEM for retention and search.
Monitor for HTTP requests with payloads matching common XSS patterns directed at the EPM management interface.
Alert on configuration changes, account additions, and policy edits performed outside of approved change windows.

How to Mitigate CVE-2025-10573

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU4 SR1 or later as directed in the vendor advisory.
Restrict network access to the EPM management interface to trusted administrative networks only.
Require administrators to use dedicated privileged access workstations when managing EPM.
Audit recent administrative actions, account changes, and policy modifications for unauthorized activity.

Patch Information

Ivanti has released a fix in Endpoint Manager 2024 SU4 SR1. Apply the update per the Ivanti Security Advisory December 2025. All 2024 service updates prior to SR1, including SU1 through SU4 and SU3 Security Release 1, require the patch.

Workarounds

Place the EPM web console behind a reverse proxy that enforces a strict Content-Security-Policy header to limit inline script execution.
Limit exposure of unauthenticated EPM endpoints to the public internet using network ACLs or VPN gating.
Train administrators to avoid clicking unsolicited links to EPM views and to log out of the console when not in use.

bash

# Example: restrict EPM management console access via host firewall (Windows)
New-NetFirewallRule -DisplayName "Restrict EPM Console" `
  -Direction Inbound -Protocol TCP -LocalPort 443 `
  -RemoteAddress 10.0.0.0/24 -Action Allow
New-NetFirewallRule -DisplayName "Block EPM Console Default" `
  -Direction Inbound -Protocol TCP -LocalPort 443 -Action Block