CVE-2024-13167
Published: 14 January 2025
Summary
CVE-2024-13167 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 18.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13167 is an out-of-bounds write vulnerability affecting Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. This flaw, classified under CWE-787, enables memory corruption due to improper bounds checking in a specific component of the software.
A remote unauthenticated attacker can exploit this vulnerability over the network with low complexity and no privileges required, as indicated by its CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H). Successful exploitation leads to a denial-of-service condition, potentially crashing the affected EPM instance and disrupting endpoint management services without impacting confidentiality or integrity.
Ivanti's security advisory for this issue, available at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6, recommends applying the January-2025 Security Updates for EPM 2024 and EPM 2022 SU6 to mitigate the vulnerability. Organizations should prioritize patching exposed EPM instances to prevent exploitation.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51393
Vulnerability details
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in public-facing EPM server directly enables remote unauthenticated exploitation (T1190) that crashes the application via memory corruption (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, prioritization, assessment, and remediation of software flaws like this out-of-bounds write vulnerability through patching Ivanti EPM.
Implements memory safeguards to protect against unauthorized access or modification, directly mitigating the memory corruption from improper bounds checking in this CVE.
Protects system availability by limiting the effects of denial-of-service attacks triggered by remote exploitation of this out-of-bounds write vulnerability.