External risk intelligence

Ivanti Endpoint Manager SQL Injection Leading to Remote Code Execution.

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2024-50330

Ivanti Endpoint Manager is an enterprise management platform that frequently includes web-based consoles and agents that are often reachable across network segments. While not always directly on the public internet, these management interfaces are commonly exposed to provide remote administration and device management capabilities, making them a likely target for remote network-based access.

SQL Injection

Ivanti Endpoint Manager

before 202220222024

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A critical vulnerability has been identified in Ivanti Endpoint Manager, a technology used for managing endpoints. This vulnerability could allow an unauthenticated remote attacker to execute malicious code on affected systems, posing a significant risk to the integrity and security of the environment. The main concern is confirming relevance and exposure to determine the potential impact.

Remote code execution flaw in endpoint manager.
Affects enterprise endpoint management tools.
Confirm relevance and exposure to assess risk.

Attack Path

How an attacker could exploit the issue

An attacker could exploit this vulnerability by sending specially crafted network requests to an exposed Ivanti Endpoint Manager component. If the system is running a vulnerable version, the attacker can manipulate database queries to execute arbitrary code on the server. This could ultimately lead to a complete compromise of the affected system.

Attacker accesses vulnerable component over network.
SQL injection triggers remote code execution.
Risk of system compromise and data theft.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in Ivanti Endpoint Manager could allow an unauthenticated attacker to execute arbitrary code remotely. Such an attacker could potentially gain control over affected systems by exploiting the SQL injection flaw when specific conditions are met. The impact could include unauthorized access and manipulation of system functions.

System control and code execution.
Remote unauthenticated network access.
Compromise of system integrity.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Ivanti Endpoint Manager platform requires immediate attention due to a critical SQL injection vulnerability that enables remote code execution. Ownership likely falls to the Endpoint Management team or Infrastructure/Operations team responsible for this software. The first practical step is to identify all instances of Ivanti Endpoint Manager, determine their network exposure, and assess business criticality to prioritize remediation efforts. Coordination with the vendor for the appropriate security updates is also a key consideration.

Own the issue: Endpoint Management or Infrastructure teams.
Verify first: Instance exposure and business criticality.
Action: Plan and coordinate vendor-provided updates.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Ivanti Endpoint Manager?

Ivanti Endpoint Manager is an enterprise-grade platform used by IT and infrastructure teams to manage, secure, and monitor devices across a network. It centralizes control over endpoints—such as laptops, desktops, and servers—allowing administrators to deploy software, apply patches, and enforce configuration policies from a unified management console.

What does CVE-2024-50330 mean?

This CVE identifies a critical SQL injection vulnerability (CWE-89) in the software. In simple terms, an attacker can send specially crafted data that tricks the application's database into executing unauthorized commands. Because of the way the system is built, this manipulation allows the attacker to run their own code on the underlying server, potentially gaining full control.

How can an attacker trigger this vulnerability?

An unauthenticated attacker triggers this by sending malicious network requests directly to an affected Ivanti Endpoint Manager component. The vulnerability is specifically tied to how the software processes these incoming requests. Simply using the software for standard administrative tasks or legitimate device management does not trigger the bug; it requires the specific, malformed input designed to exploit the SQL flaw.

Do I need to worry if my system is internal?

Yes, you should still evaluate the risk. According to Halo Surface Signal, while these management consoles are not always placed on the public internet, they are frequently reachable across various internal network segments. This means an attacker who has gained a foothold elsewhere in your network could potentially reach and exploit the management interface to escalate their access.

How should I respond to this threat?

First, identify all instances of Ivanti Endpoint Manager deployed in your environment. Prioritize these by assessing their network reachability and business criticality. Once mapped, coordinate with your infrastructure team to apply the official security updates provided by Ivanti, as patching is the required path to resolve the underlying SQL injection flaw.

References

forums.ivanti.com/s/article/Security-Advisory-EPM-November-2024-for-EPM…

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.