Ivanti warns critical EPM bug lets hackers hijack enrolled devices

Ivanti fixed a critical remote code execution (RCE) vulnerability in its Endpoint Management software (EPM) that can let unauthenticated attackers hijack enrolled devices or the core server. Ivanti EPM helps manage client devices running a wide range of platforms, from Windows and macOS to Chrome OS and IoT operating systems. The security flaw (tracked as CVE-2023-39336) impacts all supported Ivanti EPM versions, and it has been resolved in version 2022 Service Update 5. Attackers with access to a target's internal network can exploit the vulnerability in low-complexity attacks that don't require privileges or user interaction. "If exploited, an attacker with access to the internal network can leverage an unspecified SQL injection to execute arbitrary SQL queries and retrieve output without the need for authentication," Ivanti says. "This can then allow the attacker control over machines running the EPM agent. When the core server is configured to use SQL express, this might lead to RCE on the core server." The company says it has no evidence that its customers have been affected by attackers exploiting this vulnerability. Currently, Ivanti blocks public access to an advisory containing full CVE-2023-39336 details, likely to provide customers with more time to secure their devices before threat actors can create exploits using the additional information. In July, state-affiliated hackers used two zero-day flaws (CVE-2023-35078 and CVE-2023-35081) in Ivanti's Endpoint Manager...