Skip to main content
عربي
logo

NCSC-VD-2512-001-06

Severity Level: Critical

Reference No.: NCSC-VD-2512-001-06

Ivanti

Description

CVE-2025-10573: A stored cross-site scripting vulnerability in Ivanti Endpoint Manager allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator session. User interaction is required.

CVE-2025-13659: An unauthenticated arbitrary file write flaw in Ivanti EPM that can lead to remote code execution, requiring user interaction.

CVE-2025-13661: An authenticated path traversal vulnerability in Ivanti EPM enabling arbitrary file write outside intended directories, requiring user interaction.

CVE-2025-13662: An unauthenticated cryptographic signature verification bypass in Ivanti EPM leading to arbitrary code execution, requiring user interaction.

Vulnerabilities

  • CVE-2025-10573

    A stored cross-site scripting vulnerability in Ivanti Endpoint Manager allows an unauthenticated remote attacker to execute arbitrary JavaScript in an administrator session. User interaction is required.

  • CVE-2025-13659

    An unauthenticated arbitrary file write flaw in Ivanti EPM that can lead to remote code execution, requiring user interaction.

  • CVE-2025-13661

    An authenticated path traversal vulnerability in Ivanti EPM enabling arbitrary file write outside intended directories, requiring user interaction.

  • CVE-2025-13662

    An unauthenticated cryptographic signature verification bypass in Ivanti EPM leading to arbitrary code execution, requiring user interaction.

References