rxerium/CVE-2025-4427-CVE-2025-4428

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact is a README describing a Nuclei template for detecting vulnerable versions of Ivanti Endpoint Manager Mobile. It does not contain exploit or scanner code itself, but its stated purpose is version detection, which is a scanner function.

Backdoor review

No backdoor observed in reviewed code

The supplied evidence consists solely of a README.md file describing two CVEs, a detection template, and usage instructions. No executable code, scripts, or configuration files are included in the reviewed text. The README contains no concealed commands, deceptive payloads, or instructions that would cause harm to the person running the PoC. The only actionable instruction is to run a publicly available Nuclei scanner with a template, which is standard security testing behavior.

ClassificationScanner
Model confidence95%
AuthenticationUnknown
Target softwareIvanti Endpoint Manager Mobile
Attack typesauthentication bypassremote code execution
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The README explicitly states the artifact is a 'Version detection template' (line 9) and provides instructions to run it with Nuclei to check a host (lines 19-21). This is a scanner function, not an exploit. No exploit code is present in the provided text.

README.md:9README.md:19-21

Requirements

  • Requires Nuclei to run the detection template.README.md:19-21

Observed behavior

  • Describes a version detection template that matches vulnerable versions of Ivanti Endpoint Manager Mobile.README.md:7-13
  • Provides instructions to run the template with Nuclei against a target host.README.md:19-21
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Instruction
Run nuclei -u https://yourHost.com -t template.yamlThe README instructs the user to download and run the Nuclei vulnerability scanner against a target host. This is normal behavior for a PoC detection template and does not indicate a backdoor.README.md:21
Contact
Signal link: https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQwThe README provides a Signal contact link for questions. This is a common practice in open-source projects and does not constitute a backdoor.README.md:52
Review boundaries

What the analysis did not establish

  • Only the README.md file content is provided; the actual Nuclei template file (template.yaml) and any other files are omitted. The analysis is based solely on the README description.
  • The evidence packet reports complete_artifact_coverage as false, indicating not all files from the repository are included.
  • Only the README.md file was provided as readable text; two other files (likely the template.yaml and possibly a license) were present in the repository but not included in the review. Their content could not be assessed.
  • The analysis is limited to static review of the provided text; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

2