CISA has added the vulnerability to its Known Exploited Vulnerability (KEV) Catalogue.
EPM raked with RCE flaws
The 2022 and prior releases of Ivanti’s EPM, available to customers under the label service update 5 (SU5), were marred with a clutch of critical RCE bugs, including CVE-2024-29824, all receiving a severity rating of CVSS 9.6 out of 10.
The solution, which allows organizations to manage, secure, and automate the maintenance of their devices, including desktops, laptops, servers, and mobile devices, within an IT environment, was reportedly affected by a flaw that allowed a string of malicious SQL queries to be executed on the underlying databases.
