CVE-2024-13163
Published: 14 January 2025
Summary
CVE-2024-13163 is a high-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 3.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the deserialization of untrusted data vulnerability by requiring timely application of Ivanti's January 2025 security patches for EPM.
Prevents exploitation of CWE-502 by enforcing validation and error handling of untrusted input data prior to deserialization.
Mitigates remote code execution from deserialization exploits through memory protections like DEP and ASLR.
NVD Description
Deserialization of untrusted data in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to achieve remote code execution. Local user interaction is required.
Deeper analysisAI
CVE-2024-13163 is a deserialization of untrusted data vulnerability (CWE-502) in Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. Published on January 14, 2025, it carries a CVSS v3.1 base score of 7.8 (High: AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating potential for high confidentiality, integrity, and availability impacts through improper handling of untrusted data.
A remote unauthenticated attacker can exploit this vulnerability to achieve remote code execution on affected systems. Exploitation requires local user interaction, with a low attack complexity and no privileges needed from the attacker.
Ivanti's security advisory for EPM January 2025 addresses this issue through patches for EPM 2024 and EPM 2022 SU6. Practitioners should apply these updates and consult the official advisory at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6 for detailed mitigation guidance.
Details
- CWE(s)