CVE-2024-13170
Published: 14 January 2025
Summary
CVE-2024-13170 is a high-severity Out-of-bounds Write (CWE-787) vulnerability in Ivanti Endpoint Manager. Its CVSS base score is 7.5 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Application or System Exploitation (T1499.004); ranked in the top 18.3% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-5 (Denial-of-service Protection).
Deeper analysis
CVE-2024-13170 is an out-of-bounds write vulnerability affecting Ivanti Endpoint Manager (EPM) in versions prior to the 2024 January-2025 Security Update and the 2022 SU6 January-2025 Security Update. This flaw, classified under CWE-787, enables a remote unauthenticated attacker to trigger the issue, resulting in a denial of service condition. The vulnerability received a CVSS v3.1 base score of 7.5 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H), highlighting its high availability impact with network accessibility and low complexity.
A remote unauthenticated attacker can exploit this vulnerability over the network without user interaction or privileges. Successful exploitation leads to a denial of service, potentially crashing the affected EPM instance and disrupting endpoint management services.
Ivanti's security advisory recommends applying the January-2025 Security Updates for EPM 2024 and EPM 2022 SU6 to mitigate this vulnerability. Details are available at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-51396
Vulnerability details
An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Out-of-bounds write in network-reachable EPM service directly enables remote unauthenticated application/system crash via exploitation (T1499.004).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the out-of-bounds write vulnerability by identifying, reporting, and applying vendor security updates as recommended by Ivanti for affected EPM versions.
Protects system availability by implementing controls to limit or prevent the denial-of-service effects from remote exploitation of the out-of-bounds write.
Mitigates memory corruption from out-of-bounds writes through controls like address space randomization and non-executable memory to reduce crash reliability.