Discovered by researchers in October 2024 and patched by Ivanti in January 2025, these vulnerabilities (CVE-2024-10811, CVE-2024-13161, CVE-2024-13160, CVE-2024-13159) enable unauthenticated attackers to manipulate EPM servers into exposing machine account credentials for relay attacks technique that could grant domain-wide administrative control. A cluster of four critical vulnerabilities in Ivanti Endpoint Manager (EPM) has entered a dangerous new phase with the public release of proof-of-concept (PoC) exploit code, escalating risks for organizations using the enterprise device management platform. This allows attackers to force the EPM server to authenticate to a malicious SMB share using its machine account credentials, which typically possess elevated domain privileges. Privilege Escalation: Attackers forge Kerberos tickets using toolkit utilities, impersonating domain administrators to access critical services like CIFS. Industry analysts note: “Each new Ivanti vulnerability now gets scrutinized through the lens of previous breaches, creating a ‘patch fatigue’ effect that delays critical updates”. LDAP Relay Attacks: The harvested credentials get relayed to domain controllers to create unauthorized machine accounts with delegation rights.
This Cyber News was published on cybersecuritynews.com. Publication date: Thu, 20 Feb 2025 20:15:18 +0000