CVE-2025-6770

published 2025-07-08

CVE-2025-6770: OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve…

Priority P2 61 high 7.2 CVSS 3.1

AV N AC L PR H UI N S U C H I H A H

OS command injection in Ivanti Endpoint Manager Mobile (EPMM) before version 12.5.0.2 allows a remote authenticated attacker with high privileges to achieve remote code execution

Affected

3 ranges

Vendor	Product	Version range	Fixed in
ivanti	endpoint_manager_mobile	< 12.3.0.3	12.3.0.3
ivanti	endpoint_manager_mobile	>= 12.4.0.0 < 12.4.0.3	12.4.0.3
ivanti	endpoint_manager_mobile	>= 12.5.0.0 < 12.5.0.2	12.5.0.2

Detection & IOCs extracted from sources · hover to see the quote

• → Target product is Ivanti Endpoint Manager Mobile (EPMM) versions before 12.5.0.2; detect exploitation attempts via OS command injection in authenticated high-privilege sessions against EPMM endpoints ↗

• · Exploitation requires remote authentication with high privileges (not unauthenticated); scope is limited to privileged attacker sessions ↗
• · Vulnerability class is OS command injection (CWE-78) with a CVSS Base Score of 7.2 (HIGH); patched in EPMM version 12.5.0.2 ↗

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-78