CVE-2025-4428
Ivanti Endpoint Manager Mobile (EPMM) Code Injection Vulnerability
Description
CVE-2025-4428 is a high-severity remote code execution vulnerability in the API component of Ivanti Endpoint Manager Mobile (EPMM), formerly known as MobileIron Core, affecting version 12.5.0.0 and prior releases. The flaw allows an authenticated attacker with high-level privileges to execute arbitrary code on the server by sending crafted API requests that exploit improper control of code generation. With a CVSS v3.1 base score of 7.2, this code injection vulnerability enables complete system compromise. CISA has added CVE-2025-4428 to the Known Exploited Vulnerabilities catalog with a remediation deadline of June 9, 2025, and its EPSS score of 43.33% at the 97th percentile indicates an exceptionally high probability of exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | endpoint manager mobile | < 11.12.0.5; >= 12.3.0.0, < 12.3.0.2; >= 12.4.0.0, < 12.4.0.2; 12.5.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-94: Improper Control of Generation of Code ('Code Injection')
CVE-2025-4428 is classified under CWE-94, known as Code Injection. In Ivanti EPMM, the API component fails to properly neutralize special elements in user-supplied input before incorporating it into dynamically generated or interpreted code. An authenticated attacker can exploit this by sending crafted API requests that inject and execute arbitrary code within the application's runtime context, gaining full control over the EPMM server with the privileges of the application process.
Learn more: CWE-94 — Improper Control of Generation of Code ('Code Injection')
Impact Analysis
CVE-2025-4428 carries a CVSS v3.1 base score of 7.2 (High) with a network-accessible attack vector (AV:N), low attack complexity (AC:L), high privileges required (PR:H), and no user interaction needed (UI:N). While the requirement for high-level administrative privileges limits the pool of potential attackers, the impact upon successful exploitation is devastating: confidentiality, integrity, and availability are all rated high (C:H/I:H/A:H), meaning an attacker achieves complete system compromise. In environments where Ivanti EPMM manages thousands of mobile devices, exploitation grants access to device configurations, enrollment certificates, corporate policies, and potentially the entire mobile device fleet. The EPSS score of 43.33% at the 97th percentile indicates this vulnerability is among the most actively targeted. Critically, when chained with CVE-2025-4427, an authentication bypass vulnerability in the same EPMM API component, the attack becomes fully unauthenticated, dramatically increasing the risk.
Exploit Maturity
CVE-2025-4428 demonstrates very high exploit maturity. CISA has confirmed active exploitation in the wild by adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 43.33% at the 97th percentile places it among the most likely vulnerabilities to be exploited. Ivanti has published a security advisory acknowledging the vulnerability. This vulnerability is frequently chained with CVE-2025-4427 (authentication bypass), which removes the authentication requirement and enables unauthenticated remote code execution. Ivanti EPMM has a history of being targeted by sophisticated threat actors, including state-sponsored groups, making immediate patching critical for all deployments.
Remediation
- Apply Ivanti patches immediately. Upgrade EPMM to a patched version: 11.12.0.5 or later for the 11.x branch, 12.3.0.2 or later for the 12.3.x branch, 12.4.0.2 or later for the 12.4.x branch, or a version beyond 12.5.0.0 when available. Refer to the Ivanti security advisory for specific version guidance.
- Restrict API access. Immediately limit access to the EPMM API endpoints to trusted networks and authorized IP ranges. Implement network segmentation to prevent direct internet access to the EPMM server.
- Audit administrative accounts. Review all EPMM administrative accounts for unauthorized access. Disable unnecessary high-privilege accounts and enforce multi-factor authentication for all administrative access.
- Conduct forensic analysis. Examine EPMM server logs for unusual API requests, especially those containing code injection patterns or unexpected payloads. Check for indicators of compromise including unauthorized configuration changes, new admin accounts, or evidence of data exfiltration.
- Monitor for chained exploitation with CVE-2025-4427. Since this RCE vulnerability is commonly chained with the CVE-2025-4427 authentication bypass, ensure both vulnerabilities are patched simultaneously and investigate whether any unauthenticated API access occurred.
Technical Details
CVE-2025-4428 is a code injection vulnerability in the API component of Ivanti Endpoint Manager Mobile (EPMM). The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H confirms a network-accessible attack requiring high privileges but low complexity, with unchanged scope and maximum impact across all three CIA dimensions.
The vulnerability exists in how the EPMM API processes certain request parameters. The API component incorporates user-supplied data into dynamically generated or evaluated code without proper neutralization of special elements that could alter code behavior. An authenticated administrator can craft API requests containing malicious code payloads that the server interprets and executes, achieving arbitrary code execution with the privileges of the EPMM application process. This is a classic CWE-94 code injection pattern where the application fails to separate data from executable code. The high-privilege requirement is effectively negated when combined with CVE-2025-4427, which allows unauthenticated access to the API endpoints, creating a full remote code execution chain accessible without credentials.
Frequently Asked Questions
Is CVE-2025-4428 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2025-4428 to the Known Exploited Vulnerabilities catalog. The EPSS score of 43.33% at the 97th percentile indicates this is among the most actively exploited vulnerabilities. It is frequently chained with CVE-2025-4427 for unauthenticated exploitation.
What products are affected by CVE-2025-4428?
Ivanti Endpoint Manager Mobile (EPMM) versions 12.5.0.0 and prior are affected, including versions before 11.12.0.5, versions 12.3.0.0 through 12.3.0.1, and versions 12.4.0.0 through 12.4.0.1.
How do I fix CVE-2025-4428?
Upgrade EPMM to a patched version: 11.12.0.5, 12.3.0.2, 12.4.0.2, or later. Additionally, restrict API access to trusted networks, audit administrative accounts, and ensure CVE-2025-4427 is also patched to prevent chained exploitation.
How severe is CVE-2025-4428?
CVE-2025-4428 has a CVSS v3.1 base score of 7.2 (High) with maximum impact on confidentiality, integrity, and availability. When combined with CVE-2025-4427, the effective severity increases significantly as the authentication requirement is eliminated. The EPSS score of 43.33% at the 97th percentile confirms very high exploitation probability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.