CVE-2024-13169
Published: 14 January 2025
Summary
CVE-2024-13169 is a high-severity Out-of-bounds Read (CWE-125) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.8 (High).
Operationally, ranked at the 31.2th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly addresses the CVE by requiring identification, reporting, and timely remediation of software flaws like the out-of-bounds read through vendor security updates.
Implements memory protection mechanisms such as address space layout randomization and data execution prevention that directly mitigate out-of-bounds read and type confusion exploits.
Enforces least privilege to limit the scope and impact of privilege escalation even if the out-of-bounds read vulnerability is exploited by a low-privileged local attacker.
NVD Description
An out-of-bounds read in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a local authenticated attacker to escalate their privileges.
Deeper analysisAI
CVE-2024-13169 is an out-of-bounds read vulnerability affecting Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. The issue stems from CWE-125 (out-of-bounds read) and CWE-843 (type confusion), enabling improper memory access. It carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact on confidentiality, integrity, and availability.
A local authenticated attacker with low privileges can exploit this vulnerability to escalate their privileges on the affected system. The attack requires local access and low attack complexity, with no user interaction needed, allowing the attacker to gain higher-level access and potentially execute arbitrary code or manipulate system resources.
Ivanti's security advisory recommends applying the January-2025 Security Updates for EPM 2024 and EPM 2022 SU6 to mitigate the vulnerability, as detailed at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6.
Details
- CWE(s)