CVE-2025-62384: Ivanti Endpoint Manager SQLI Vulnerability

CVE-2025-62384 Overview

CVE-2025-62384 is a SQL injection vulnerability in Ivanti Endpoint Manager (EPM) affecting versions prior to 2024 SU5. A remote authenticated attacker can inject crafted SQL statements through an affected input and read arbitrary data from the backend database. The flaw is categorized under [CWE-89] Improper Neutralization of Special Elements used in an SQL Command. Ivanti disclosed the issue in its October 2025 security advisory and shipped a fix in the 2024 SU5 release. The vulnerability requires valid authentication but no user interaction, making it exploitable by any account with console access.

Critical Impact
An authenticated attacker can exfiltrate sensitive configuration data, credentials, inventory records, and management metadata stored in the Ivanti EPM database.

Affected Products

Ivanti Endpoint Manager 2024 (base release)
Ivanti Endpoint Manager 2024 SU1, SU2, SU3, and SU3 Security Release 1
All Ivanti Endpoint Manager versions prior to 2024 SU5

Discovery Timeline

2025-10-13 - CVE-2025-62384 published to the National Vulnerability Database
2025-10-13 - Ivanti publishes the Ivanti Security Advisory - EPM October 2025
2026-10-08 - Last updated in NVD database

Technical Details for CVE-2025-62384

Vulnerability Analysis

The vulnerability resides in a database query path reachable by authenticated users of Ivanti Endpoint Manager. User-controlled input is concatenated into a SQL statement without proper parameterization or input validation. An attacker who holds valid EPM credentials can submit crafted payloads that alter the structure of the query. The database engine then executes attacker-controlled SQL clauses in the context of the EPM service account.

Successful exploitation enables arbitrary read access to database tables. EPM databases typically store device inventory, deployed software, patch state, policy definitions, and administrative metadata. Confidentiality impact is high while integrity and availability are not directly affected per the published CVSS vector. Exploitation does not require user interaction, which simplifies automation once credentials are obtained.

Root Cause

The root cause is improper neutralization of SQL special characters in a server-side query handler. The affected code builds SQL dynamically from request parameters rather than using prepared statements with bound parameters. This allows attackers to break out of the intended query context using classic injection primitives such as UNION-based reads or boolean-based blind extraction.

Attack Vector

The attack is executed over the network against the EPM management interface. The attacker must first authenticate with any valid account recognized by EPM, including low-privilege operators depending on the exposed endpoint. Once authenticated, the attacker issues HTTP requests containing crafted SQL fragments embedded in a vulnerable parameter. Specific proof-of-concept code and the exact vulnerable endpoint have not been published by the vendor.

See the Ivanti Security Advisory - EPM October 2025 for vendor-confirmed technical scope.

Detection Methods for CVE-2025-62384

Indicators of Compromise

Unexpected SQL syntax, UNION keywords, or encoded quote characters appearing in EPM web request parameters or IIS logs.
Authenticated EPM sessions issuing abnormally high volumes of similar requests with incrementing payloads, consistent with blind SQL extraction.
Database audit records showing the EPM service account querying tables outside its normal application workload.
Outbound data transfers from the EPM server following suspicious authenticated API activity.

Detection Strategies

Enable SQL Server auditing on the EPM database and alert on queries containing injection signatures such as UNION SELECT, WAITFOR DELAY, or CONVERT( errors.
Deploy WAF or reverse-proxy rules in front of the EPM console that inspect query strings and POST bodies for SQL metacharacters.
Correlate EPM authentication logs with web request logs to identify sessions that deviate from normal administrative behavior.
Baseline the EPM service account's query patterns and alert on new table access or schema enumeration activity.

Monitoring Recommendations

Forward EPM IIS logs, Windows event logs, and SQL Server audit logs to a centralized analytics platform for correlation.
Monitor for creation of new EPM accounts, privilege changes, and failed logins that may precede exploitation attempts.
Track egress bandwidth from the EPM server and alert on anomalies consistent with database exfiltration.

How to Mitigate CVE-2025-62384

Immediate Actions Required

Upgrade Ivanti Endpoint Manager to version 2024 SU5 or later as published in the Ivanti October 2025 advisory.
Rotate credentials for all EPM administrative and operator accounts, and review account inventory for unused or stale accounts.
Restrict network access to the EPM management console to trusted administrative networks and VPN segments.
Review database audit logs for the period preceding the patch to identify any prior exploitation attempts.

Patch Information

Ivanti released a fix for CVE-2025-62384 in Ivanti Endpoint Manager 2024 SU5. Administrators should apply the update per the vendor-supplied upgrade path. Refer to the Ivanti Security Advisory - EPM October 2025 for the official download, checksum, and installation guidance.

Workarounds

No vendor-approved workaround substitutes for the patch. Apply 2024 SU5 as soon as practical.
Reduce authenticated attack surface by enforcing strong password policies, multi-factor authentication where supported, and least-privilege role assignments for EPM users.
Place the EPM console behind a web application firewall configured to block common SQL injection payloads until patching is complete.

bash

# Configuration example: restrict EPM console access with Windows Firewall
# Replace 10.0.10.0/24 with your administrative subnet
New-NetFirewallRule -DisplayName "Allow EPM Console - Admin Subnet" `
    -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443 `
    -RemoteAddress 10.0.10.0/24

New-NetFirewallRule -DisplayName "Block EPM Console - All Others" `
    -Direction Inbound -Action Block -Protocol TCP -LocalPort 443