CVE DatabaseCVE-2025-4428

Updated 2026-06-17한국어 권고문 →

CVE-2025-44288.8/HIGHCISA KEVCWE-94

Ivanti Endpoint Manager Mobile (EPMM) API Remote Code Execution (RCE) Vulnerability Advisory (CVE-2025-4428)

⚡ Jump to Patch

Affected Vendors

ivanti

Affected Components

endpoint manager mobile, epmm

Published Date

2025-05-13

CVSS v3.1

8.8

HIGH

EPSS (30d)

88.0%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior

Impact

Authenticated attackers can execute arbitrary code with elevated privileges via crafted API requests, potentially leading to full system compromise.

Mitigation

Immediately apply the official security patches provided by Ivanti and restrict external access to the API endpoints.

Affected Products & Version Scope

Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior on all platforms

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Administrators should immediately upgrade to the patched versions via the Ivanti standard update procedure. Below is an example of upgrading the system via the EPMM CLI.

bash

# Access the EPMM CLI and enter privileged mode
enable
configure terminal

# Check and download the latest security update
software update check
software update download

# Install the update and reboot the appliance
software update install
reload

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to the EPMM API endpoints (e.g., /mifs/api/) using a reverse proxy or firewall to allow only trusted IP addresses.

nginx

# Nginx Reverse Proxy Configuration Example: Restricting API Access
server {
    listen 443 ssl;
    server_name epmm.example.com;

    location /mifs/api/ {
        allow 10.0.0.0/8;
        allow 192.168.1.0/24;
        deny all;
        
        proxy_pass https://backend_epmm;
    }
}

3. Log Audit & IoC Verification Commands

Run the following script to inspect web server access logs for suspicious API requests and verify the installed package version.

bash

# Scan EPMM API access logs for potential command injection patterns
echo '[*] Scanning logs for suspicious API payloads...'
grep -Ei '(/api/|/mifs/api/).*(sh|bash|cmd|exec|eval|system|concat)' /var/log/httpd/access_log

# Verify the currently installed EPMM package version
echo '[*] Checking installed EPMM package version...'
rpm -qa | grep -i 'mobileiron' || dpkg -l | grep -i 'mobileiron'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

NordLayer / Zero-Trust Network Access

Due to active exploitation in the wild, immediate patching of all Ivanti EPMM instances is highly recommended.

Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access

Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.

90% Attack Surface Reduction · Hardware-Free

Explore Zero-Trust Network Access Plans

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-4428) is a code injection vulnerability (CWE-94) residing within the API component of Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron Core). The root cause is insufficient input validation and sanitization of user-supplied data within API requests. This allows authenticated attackers to inject and execute arbitrary code on the underlying operating system.

2. Exploitation Mechanics & Attack Scenario

An attacker must first obtain valid credentials to authenticate against the EPMM API. Once authenticated, the attacker transmits a specially crafted HTTP request to a vulnerable API endpoint containing malicious payloads within the parameters. Due to the lack of strict input filtering, the application processes the payload as executable code, allowing the attacker to run arbitrary system commands in the context of the web server.

3. Infrastructure & Business Impact

EPMM is a critical enterprise asset used to manage mobile device fleets and enforce security policies. This vulnerability is listed in the CISA KEV (Known Exploited Vulnerabilities) catalog, indicating active exploitation in the wild. Successful exploitation allows attackers to gain full administrative control over the MDM server, pivot into internal networks, and potentially push malicious configurations to enrolled mobile devices.

Official Vendor Advisories & References

NVD Original English Description

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75 · Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4428

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-4428)

FAQ

Q1. How critical is CVE-2025-4428 and is it actively exploited in the wild?

CVE-2025-4428 is rated CVSS 8.8 (HIGH) with a 30-day EPSS exploitation probability of 88.0%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-4428?

Primary impacted vendors include ivanti across endpoint manager mobile, epmm. Scope summary: Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior on all platforms

Q3. What temporary mitigations or workarounds exist for CVE-2025-4428 before patching?

[Mitigation] Immediately apply the official security patches provided by Ivanti and restrict external access to the API endpoints. Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION