KEVIntel
Back to KEVs
5.3
CVSS
Medium

CVE-2025-4427

PUBLISHED

Authentication Bypass

Exploited in the wild Remote Low complexity No user interaction
Vendor
Ivanti
Product
Endpoint Manager Mobile
Published
May 13, 2025
EPSS
50.4% · 98% pctl

Description

An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior allows attackers to access protected resources without proper credentials via the API.

cisa nuclei_scanner edge metasploit

CVSS scores

CVSS v3.1 5.3 Medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitation status

Exploited in the wild

Recorded 2025-05-21 13:11:30 UTC · Source

SSVC decision points

Exploitation
active
Automatable
Yes
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CVE May 21, 2025

Scanner integrations

Scanner Reference Detected
Metasploit https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/ivanti_epmm_rce_cve_2025_4427_4428.rb Jun 09, 2025
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-4427.yaml Jun 02, 2025

Recent mentions

Chinese Hackers Exploit Ivanti EPMM Bugs in Global Enterprise Network Attacks

TheHackerNews · May 22, 2025

A recently patched pair of security flaws affecting Ivanti Endpoint Manager Mobile (EPMM) software has been exploited by a China-nexus threat actor to target a wide range of sectors across Europe, North America, and the Asia-Pacific region. The vulnerabilities, tracked as CVE-2025-4427 (CVSS score: 5.3) and CVE-2025-4428 (CVSS score: 7.2), could be chained to execute arbitrary code on a

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Detected by Nuclei

  • Detected by Metasploit