CVE-2024-13164

CVE-2024-13164 involves an uninitialized resource (CWE-908) in Ivanti Endpoint Manager (EPM) versions prior to the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update. Published on January 14, 2025, this local privilege escalation vulnerability carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating high impact potential from low-privilege local access.

A local authenticated attacker with low privileges can exploit the uninitialized resource with low attack complexity and no user interaction. Exploitation enables privilege escalation, providing high confidentiality, integrity, and availability impacts on the affected system.

Ivanti's January 2025 security advisory for EPM 2024 and EPM 2022 SU6 details patches addressing this vulnerability. Security practitioners should apply these updates immediately to mitigate the risk, as outlined in the advisory at https://forums.ivanti.com/s/article/Security-Advisory-EPM-January-2025-for-EPM-2024-and-EPM-2022-SU6.