CVE-2021-44529criticalunder attackransomwareCWE-94

CVE-2021-44529: critical vulnerability in Ivanti EPM

Published · Updated

Follow this CVE+ Monitor EPM+ Monitor Endpoint Manager Cloud Service Appliance

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 99%
from disclosure to weapon104 days
Published on NVDDec 8
1st PoC+104d
metasploitDec 2
CISA KEV+838d
Action required by CISAfederal deadline: 2024-04-15

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

An attacker can inject and run malicious code on Ivanti EPM Cloud Services Appliance without needing a password, though with limited access rights. This is dangerous because it allows unauthorized control over the system.

Technical detail

CWE-94 code injection vulnerability in Ivanti EPM CSA permits unauthenticated remote code execution via unsanitized input, executing with 'nobody' user privileges. Attack requires no authentication and directly compromises system integrity and confidentiality.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

A code injection vulnerability in the Ivanti EPM Cloud Services Appliance (CSA) allows an unauthenticated user to execute arbitrary code with limited permissions (nobody).
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · Ivanti EPM
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.