CVE-2024-29847

CRITICAL

Ivanti EPM <2022 SU6-2024 September - Code Injection

Title source: llm

Description

Deserialization of untrusted data in the agent portal of Ivanti EPM before 2022 SU6, or the 2024 September update allows a remote unauthenticated attacker to achieve remote code execution.

Exploits (2)

nomisec WRITEUP 18 stars

by sinsinology · poc

https://github.com/sinsinology/CVE-2024-29847

View Code ZIP pw:eip

inthewild WORKING POC

poc

https://github.com/horizon3ai/cve-2024-29847

View Code ZIP pw:eip

References (1)

[Vendor Advisory] https://forums.ivanti.com/s/article/Security-Advisory-EPM-September-2024-for-EPM-2024-and-EPM-2022

Scores

CVSS v3 9.8

EPSS 0.6723

EPSS Percentile 98.5%

Attack Vector NETWORK

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

CWE

CWE-502

Status published

Affected Products (8)

ivanti/endpoint_manager < 2022

ivanti/endpoint_manager

Timeline

Published Sep 12, 2024

Tracked Since Feb 18, 2026