CVE-2024-13169
Published: 14 January 2025
Summary
CVE-2024-13169 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 37.9th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-13169 is an out-of-bounds read vulnerability affecting Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. The issue stems from CWE-125 (out-of-bounds read) and CWE-843 (type confusion), enabling improper memory access. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
A local authenticated attacker with low privileges can exploit this vulnerability to escalate their privileges on the affected system. The attack requires local access and low attack complexity, with no user interaction needed, allowing the attacker to gain higher-level access and potentially execute arbitrary code or manipulate system resources.
Ivanti's security advisory recommends applying the January-2025 Security Updates for EPM 2024 and EPM 2022 SU6 to mitigate the vulnerability, as detailed at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51395
Vulnerability details
An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Local authenticated attacker exploits out-of-bounds read/type confusion for privilege escalation on the host.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly addresses the CVE by requiring identification, reporting, and timely remediation of software flaws like the out-of-bounds read through vendor security updates.
Implements memory protection mechanisms such as address space layout randomization and data execution prevention that directly mitigate out-of-bounds read and type confusion exploits.
Enforces least privilege to limit the scope and impact of privilege escalation even if the out-of-bounds read vulnerability is exploited by a low-privileged local attacker.