CVE-2024-13164
Published: 14 January 2025
Summary
CVE-2024-13164 is a high-severity Use of Uninitialized Resource (CWE-908) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of system flaws such as uninitialized resource usage, directly mitigating this privilege escalation vulnerability through patching as provided by Ivanti.
Implements memory protection controls like address space randomization and non-executable memory that minimize exploitation of uninitialized resources leading to privilege escalation.
Enforces least privilege to limit the scope and impact of privilege escalation attempts by low-privileged local authenticated attackers.
NVD Description
An uninitialized resource in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
Deeper analysisAI
CVE-2024-13164 involves an uninitialized resource (CWE-908) in Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. Published on January 14, 2025, this local privilege escalation vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from low-privilege local access.
A local authenticated attacker with low privileges can exploit the uninitialized resource with low attack complexity and no user interaction. Exploitation enables privilege escalation, providing high confidentiality, integrity, and availability impacts on the affected system.
Ivanti's January 2025 security advisory for EPM 2024 and EPM 2022 SU6 details patches addressing this vulnerability. Security practitioners should apply these updates immediately to mitigate the risk, as outlined in the advisory at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6.
Details
- CWE(s)