CVE-2025-22459

MEDIUM EPSS 20.7%
Published Apr 8, 20251y ago · Modified Jun 17, 20261w ago
4.8 CVSS 3.1
Medium
Find Similar
Published Apr 8, 2025 1y ago
Last Modified Jun 17, 2026 1w ago

Description

Improper certificate validation in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows a remote unauthenticated attacker to intercept limited traffic between clients and servers.

CVSS Details

Base Score
4.8
Exploitability
2.2
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity High
Privileges Required None
User Interaction None
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
20.7% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-295
CWE-296

Affected Products 9

VendorProductVersionRange
ivantiendpoint_manager* <2022
ivantiendpoint_manager2022any
ivantiendpoint_manager2022any
ivantiendpoint_manager2022any
ivantiendpoint_manager2022any
ivantiendpoint_manager2022any
ivantiendpoint_manager2022any
ivantiendpoint_manager2022any
ivantiendpoint_manager2024any

References 1

  • forums.ivanti.com https://forums.ivanti.com/s/article/Security-Advisory-EPM-April-2025-for-EPM-2024-and-EPM-2022-SU6
    Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.