CVE-2025-6995: Ivanti Endpoint Manager Info Disclosure

CVE-2025-6995 Overview

CVE-2025-6995 is a cryptographic vulnerability affecting Ivanti Endpoint Manager (EPM) that stems from improper use of encryption in the agent component. This weakness allows a local authenticated attacker to decrypt other users' passwords stored on the system. The vulnerability is classified under CWE-257 (Storing Passwords in a Recoverable Format), indicating that the encryption implementation fails to adequately protect sensitive credential data.

This security flaw poses significant risks in enterprise environments where Ivanti Endpoint Manager is deployed for unified endpoint management. A malicious insider or an attacker who has gained initial local access could leverage this vulnerability to harvest credentials from other user accounts, potentially enabling lateral movement across the organization's network.

Critical Impact

Local authenticated attackers can decrypt passwords belonging to other users, enabling credential theft and potential privilege escalation across managed endpoints.

Affected Products

• Ivanti Endpoint Manager 2024 (prior to SU3)
• Ivanti Endpoint Manager 2022 (prior to SU8 Security Update 1)
• Ivanti Endpoint Manager 2024 SU1 and SU2

Discovery Timeline

• 2025-07-08 - CVE-2025-6995 published to NVD
• 2025-07-11 - Last updated in NVD database

Technical Details for CVE-2025-6995

Vulnerability Analysis

The vulnerability resides in how the Ivanti Endpoint Manager agent handles password encryption and storage. Rather than implementing proper one-way cryptographic hashing for password storage, the agent uses a reversible encryption scheme that allows recovery of the original plaintext passwords. This design flaw means that any user with local access to the system and the ability to access the encrypted password data can potentially reverse the encryption to obtain cleartext credentials.

The scope of this vulnerability extends beyond the initially compromised system, as indicated by the "Changed" scope in the security assessment. This means that a successful exploit could impact resources beyond the vulnerable component itself—specifically, credentials obtained could be used to access other systems and services within the organization.

Root Cause

The root cause is improper implementation of password storage encryption in the Ivanti EPM agent. According to CWE-257 (Storing Passwords in a Recoverable Format), the software stores user passwords in a way that allows their recovery, rather than using industry-standard one-way hashing algorithms with proper salting. This likely involves either weak encryption algorithms, hardcoded or predictable encryption keys, or an encryption scheme that can be reversed by any authenticated local user.

Attack Vector

The attack requires local access to a system running the vulnerable Ivanti Endpoint Manager agent. An attacker with low-privilege local authentication can exploit this vulnerability without any user interaction. The attack flow typically involves:

1. The attacker gains local authenticated access to a managed endpoint
2. The attacker locates the encrypted password storage used by the EPM agent
3. Using knowledge of the encryption implementation or accessible key material, the attacker decrypts stored passwords
4. The recovered credentials can then be used for lateral movement or privilege escalation

The vulnerability does not require network access and can be exploited entirely through local system interaction, making it particularly dangerous in scenarios where an organization has insider threats or where initial compromise has already occurred.

Detection Methods for CVE-2025-6995

Indicators of Compromise

• Unusual access to Ivanti EPM agent configuration files or credential storage locations
• Suspicious processes attempting to read or decrypt EPM agent data stores
• Anomalous authentication attempts using credentials that may have been harvested from EPM agent storage
• Unexpected file access patterns in directories containing EPM agent credential data

Detection Strategies

• Monitor for unauthorized access to Ivanti EPM agent directories and configuration files
• Implement file integrity monitoring on EPM agent credential storage locations
• Deploy endpoint detection rules to identify processes attempting to extract or decrypt EPM agent data
• Correlate authentication events across systems to detect credential reuse patterns indicative of harvesting

Monitoring Recommendations

• Enable detailed audit logging on systems running Ivanti Endpoint Manager agents
• Configure SIEM rules to alert on multiple failed authentication attempts following potential credential extraction events
• Implement behavioral analysis to detect deviations from normal EPM agent access patterns
• Review authentication logs for signs of lateral movement using potentially compromised credentials

How to Mitigate CVE-2025-6995

Immediate Actions Required

• Upgrade Ivanti Endpoint Manager 2024 installations to SU3 or later immediately
• Upgrade Ivanti Endpoint Manager 2022 installations to SU8 Security Update 1 or later
• Rotate all passwords that may have been stored by vulnerable EPM agent versions
• Review access logs for signs of credential extraction prior to patching
• Implement enhanced monitoring for lateral movement using potentially compromised credentials

Patch Information

Ivanti has released security updates to address this vulnerability. Organizations should apply the following patches based on their EPM version:

• Ivanti EPM 2024: Upgrade to Security Update 3 (SU3) or later
• Ivanti EPM 2022: Upgrade to Security Update 8 (SU8) with Security Update 1 or later

Detailed patching instructions and downloads are available in the Ivanti Security Advisory for July 2025.

Workarounds

• Restrict local access to systems running EPM agents to only essential personnel
• Implement strict access controls on EPM agent installation directories and data stores
• Deploy additional endpoint protection to detect and block credential extraction attempts
• Segment networks to limit the impact of potential credential compromise

# Verify Ivanti EPM version and check for security update status
# Consult Ivanti documentation for version verification commands
# After patching, rotate credentials stored by EPM agents