8.4

CVE-2025-6996

Improper Encryption in Ivanti Endpoint Manager

Improper use of encryption in the agent of Ivanti Endpoint Manager before version 2024 SU3 and 2022 SU8 Security Update 1 allows a local authenticated attacker to decrypt other users’ passwords.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Ivanti ≫ Endpoint Manager Version < 2022
Ivanti ≫ Endpoint Manager Version 2022 Update -
Ivanti ≫ Endpoint Manager Version 2022 Update su1
Ivanti ≫ Endpoint Manager Version 2022 Update su2
Ivanti ≫ Endpoint Manager Version 2022 Update su3
Ivanti ≫ Endpoint Manager Version 2022 Update su4
Ivanti ≫ Endpoint Manager Version 2022 Update su5
Ivanti ≫ Endpoint Manager Version 2022 Update su6
Ivanti ≫ Endpoint Manager Version 2022 Update su7
Ivanti ≫ Endpoint Manager Version 2022 Update su8
Ivanti ≫ Endpoint Manager Version 2024 Update -
Ivanti ≫ Endpoint Manager Version 2024 Update su1
Ivanti ≫ Endpoint Manager Version 2024 Update su2
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. Login Login
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.19% 0.094
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
3c1d8aa1-5a33-4ea4-8992-aadd6440af75 8.4 2 5.8
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N
CWE-257 Storing Passwords in a Recoverable Format

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.

https://forums.ivanti.com/s/article/Security-Advisory-July-2025-for-Ivanti-EPM-2024-SU2-and-EPM-2022-SU8
Vendor Advisory