Ivanti Endpoint Manager (EPM) Absolute Path Traversal and Information Disclosure Vulnerability (CVE-2024-13161) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTIvanti EPM versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update
Remote unauthenticated attackers can exploit absolute path traversal to leak highly sensitive system information
Immediately apply the official Ivanti security updates and restrict access to the EPM management interfaces
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Download and install the latest security updates (January 2025 or later) from the official Ivanti Community portal. Use the following PowerShell commands to verify the current version and restart services after applying the patch.
# Check the installed Ivanti EPM version via Registry
Get-ItemProperty -Path 'HKLM:\SOFTWARE\Intel\LANDesk\LDWM' -Name 'Version' -ErrorAction SilentlyContinue
# Restart Ivanti services to ensure the patch is fully applied
Restart-Service -Name 'LANDesk*' -Force2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the Ivanti EPM web console (default ports TCP 443, 80) using firewall rules. Ensure that only trusted administrative subnets can access these ports.
# Block external access to EPM web port (443) and allow only trusted admin subnet (10.0.0.0/8)
New-NetFirewallRule -DisplayName 'Block External Ivanti EPM Access' -Direction Inbound -LocalPort 443 -Protocol TCP -Action Block
New-NetFirewallRule -DisplayName 'Allow Admin Subnet to EPM' -Direction Inbound -LocalPort 443 -Protocol TCP -RemoteAddress '10.0.0.0/8' -Action Allow -Profile Domain, Private3. Log Audit & IoC Verification Commands
Inspect IIS web server logs and Ivanti EPM logs for suspicious requests containing absolute path patterns or system directory references.
# Search IIS logs for potential path traversal attempts targeting system files
grep -Ei '(/|%2f|\\|%5c)(windows|winnt|system32|boot\.ini|web\.config)' /var/log/iis/*.logStop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-13161) is an absolute path traversal flaw (CWE-36) residing within Ivanti Endpoint Manager (EPM). The root cause is the application's failure to properly sanitize and validate user-supplied input when resolving file paths. This allows an attacker to bypass directory restrictions by supplying absolute file paths directly to the vulnerable endpoint.
2. Exploitation Mechanics & Attack Scenario
A remote, unauthenticated attacker can craft a malicious HTTP request containing absolute file paths (e.g., 'C:\Windows\...' or specific configuration file paths). Because the application processes these paths without adequate validation, it retrieves and returns the contents of the requested files in the HTTP response. This can lead to the exposure of sensitive configuration files, credentials, and system logs, which can be leveraged for credential coercion and lateral movement.
3. Infrastructure & Business Impact
Ivanti EPM is a critical enterprise asset management solution. This vulnerability is actively exploited in the wild and is listed in the CISA KEV catalog. With an EPSS score of 0.8981 (89.81%), it represents an immediate threat. Successful exploitation can lead to full compromise of the EPM server, exposing administrative credentials and potentially allowing attackers to compromise all managed endpoints across the enterprise.
Official Vendor Advisories & References
Absolute path traversal in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to leak sensitive information.
Frequently Asked SecOps Questions (CVE-2024-13161)
FAQQ1. How critical is CVE-2024-13161 and is it actively exploited in the wild?
CVE-2024-13161 is rated CVSS 7.5 (HIGH) with a 30-day EPSS exploitation probability of 89.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-13161?
Primary impacted vendors include ivanti across endpoint manager, epm. Scope summary: Ivanti Endpoint Manager (EPM) 2024 (prior to January-2025 Security Update) and EPM 2022 SU6 (prior to January-2025 Security Update)
Q3. What temporary mitigations or workarounds exist for CVE-2024-13161 before patching?
[Mitigation] Immediately apply the official Ivanti security updates and restrict access to the EPM management interfaces Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-13161
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (ivanti)
View Category →Ivanti Endpoint Manager (EPM) Authentication Bypass and Credential Leak Vulnerability (CVE-2026-1603) Urgent Security Advisory
[Affected Scope] Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5
Ivanti Sentry OS Command Injection and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-10520)
[Affected Scope] Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1
Ivanti Connect Secure (ICS) Authentication Bypass and Remote Code Execution (RCE) Advisory (CVE-2026-104935)
[Affected Scope] Ivanti Connect Secure (ICS) versions prior to 25.1.3.0 (excluding 22.7R2.14 and earlier)
Ivanti EPMM (Endpoint Manager Mobile) Remote Code Execution Vulnerability Advisory (CVE-2026-6973)
[Affected Scope] Ivanti EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.