CVE-2025-4427

Published: May 13, 2025Modified: Oct 24, 2025CISA KEV

7.5

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

Affected (4)

Products: Ivanti: Endpoint Manager Mobile

Ivanti

1 product

Endpoint Manager Mobile

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Ivanti Endpoint Manager Mobile	Before 11.12.0.5
Ivanti Endpoint Manager Mobile	From 12.3.0.0 to 12.3.0.2
Ivanti Endpoint Manager Mobile	From 12.4.0.0 to 12.4.0.2
Ivanti Endpoint Manager Mobile	Version 12.5.0.0

Related CWEs

CWE-288

Authentication Bypass Using an Alternate Path or Channel

A product requires authentication, but the product has an alternate path or channel that does not require authentication.

References (2)

https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM

Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75

Vendor Advisory

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-4427

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0

US Government Resource

Timeline

No history available yet.