CVE-2024-13170
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to cause denial of service through an out-of-bounds write in Ivanti EPM. It affects Ivanti EPM 2024 versions before the January-2025 security update and EPM 2022 SU6 versions before the January-2025 security update. Organizations using these vulnerable versions are at risk.
💻 Affected Systems
- Ivanti Endpoint Manager (EPM)
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete system crash or service disruption leading to extended downtime of Ivanti EPM services
Likely Case
Service disruption affecting endpoint management capabilities until system restart
If Mitigated
Minimal impact with proper network segmentation and access controls limiting exposure
🎯 Exploit Status
The vulnerability requires crafting specific network requests to trigger the out-of-bounds write condition. No authentication is required.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024 January-2025 Security Update for EPM 2024, 2022 SU6 January-2025 Security Update for EPM 2022 SU6
Vendor Advisory: https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6
Restart Required: Yes
Instructions:
1. Download the appropriate security update from Ivanti's support portal. 2. Apply the update following Ivanti's installation documentation. 3. Restart the EPM services or server as required.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to Ivanti EPM services to trusted IP addresses only
Service Isolation
allPlace EPM servers in isolated network segments with strict firewall rules
🧯 If You Can't Patch
- Implement strict network segmentation and firewall rules to limit access to EPM services
- Monitor EPM service health and logs for signs of exploitation or service disruption
🔍 How to Verify
Check if Vulnerable:
Check EPM version in Ivanti EPM console or via registry: HKEY_LOCAL_MACHINE\SOFTWARE\LANDesk\ManagementSuite\VersionCheck Version:
reg query "HKLM\SOFTWARE\LANDesk\ManagementSuite" /v VersionVerify Fix Applied:
Verify installed version matches or exceeds the January-2025 security update version📡 Detection & Monitoring
Log Indicators:
- Unexpected service crashes in Windows Event Logs
- EPM service termination events
- High volume of malformed requests to EPM ports
Network Indicators:
- Unusual traffic patterns to EPM service ports (default 80/443, 8443)
- Requests with malformed payloads to EPM endpoints
SIEM Query:
source="windows" AND (event_id=7034 OR event_id=1000) AND process_name="*epm*" OR service_name="*epm*"