Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.

2025-05-20 00:00:00

None

41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe

attack.initial-access attack.t1190 attack.execution attack.t1203 cve.2025-4427 cve.2025-4428 detection.emerging-threats

Community Rule

Swachchhanda Shrawan Poudel

Merge PR #5427 from @swachchhanda000 - Add `Potential Exploitation of CVE-2025-4427/4428 Ivanti EPMM Pre-Auth RCE`

2025-05-21