CVE-2024-13161 — AI Deep Analysis Summary

Q: Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-36** (Absolute Path Traversal). 🔍 **Flaw**: Improper input validation in the **wildcard parameter** of the `GetHashForSingleFile` endpoint.

Q: Who is affected? (Versions/Components)

🏢 **Affected**: **Ivanti Endpoint Manager (EPM)**. 📅 **Context**: Specifically noted in Jan 2025 advisory for **EPM 2024** and **EPM 2022 SU6**.

Q: What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: 1. **Coerce NTLM auth** via remote UNC path. 2. **Steal credentials** (Machine Account). 3. **Exfiltrate sensitive data** from the server.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. 🔓 **Auth**: **Unauthenticated** (No login needed). 🌐 **Access**: Network vector (AV:N), Low Complexity (AC:L).

Q: Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exp?**: **YES**. 📂 **PoC**: Available via **ProjectDiscovery Nuclei** templates. ⚠️ **Risk**: Easy to automate and exploit widely.

Q: How to self-check? (Features/Scanning)

🔎 **Self-Check**: 1. Scan for **Ivanti EPM** endpoints. 2. Use **Nuclei** template for CVE-2024-13161. 3. Check for **wildcard parameter** exposure in `GetHashForSingleFile`.

Q: Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. 📝 **Advisory**: Ivanti released security advisory in **Jan 2025**. ✅ **Action**: Update to the latest secure version immediately.

Q: What if no patch? (Workaround)

🚧 **No Patch?**: 1. **Block** external access to EPM endpoints. 2. **Restrict** NTLM authentication protocols. 3. **Monitor** for suspicious UNC path requests.

Q: Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. ⏱️ **Priority**: **P0**. 🚀 **Reason**: Unauthenticated, remote, high CVSS score, and active PoC exists. Patch NOW.

Updated May 06, 2026 CVSS 9.8 · Critical

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Ivanti EPM has a critical **Absolute Path Traversal** flaw.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **Root Cause**: **CWE-36** (Absolute Path Traversal). <br>🔍 **Flaw**: Improper input validation in the **wildcard parameter** of the `GetHashForSingleFile` endpoint.

Q3Who is affected? (Versions/Components)

🏢 **Affected**: **Ivanti Endpoint Manager (EPM)**. <br>📅 **Context**: Specifically noted in Jan 2025 advisory for **EPM 2024** and **EPM 2022 SU6**.

Q4What can hackers do? (Privileges/Data)

💀 **Attacker Actions**: <br>1. **Coerce NTLM auth** via remote UNC path. <br>2. **Steal credentials** (Machine Account). <br>3. **Exfiltrate sensitive data** from the server.

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: **LOW**. <br>🔓 **Auth**: **Unauthenticated** (No login needed). <br>🌐 **Access**: Network vector (AV:N), Low Complexity (AC:L).

Q6Is there a public Exp? (PoC/Wild Exploitation)

💣 **Public Exp?**: **YES**. <br>📂 **PoC**: Available via **ProjectDiscovery Nuclei** templates. <br>⚠️ **Risk**: Easy to automate and exploit widely.

Q7How to self-check? (Features/Scanning)

🔎 **Self-Check**: <br>1. Scan for **Ivanti EPM** endpoints. <br>2. Use **Nuclei** template for CVE-2024-13161. <br>3. Check for **wildcard parameter** exposure in `GetHashForSingleFile`.

Q8Is it fixed officially? (Patch/Mitigation)

🩹 **Official Fix**: **YES**. <br>📝 **Advisory**: Ivanti released security advisory in **Jan 2025**. <br>✅ **Action**: Update to the latest secure version immediately.

Q9What if no patch? (Workaround)

🚧 **No Patch?**: <br>1. **Block** external access to EPM endpoints. <br>2. **Restrict** NTLM authentication protocols. <br>3. **Monitor** for suspicious UNC path requests.

Q10Is it urgent? (Priority Suggestion)

🔥 **Urgency**: **CRITICAL**. <br>⏱️ **Priority**: **P0**. <br>🚀 **Reason**: Unauthenticated, remote, high CVSS score, and active PoC exists. Patch NOW.

Continue exploring

Vulnerability detail Full AI analysis (login) Ivanti CWE-36