CVE-2025-10573

Published Dec 9, 2025

Last updated 5 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-10573 is a stored cross-site scripting (XSS) vulnerability found in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU4 SR1. It stems from improper neutralization of user-supplied input during web page generation. An attacker with unauthenticated access to the primary EPM web service can inject malicious JavaScript code into the administrator web dashboard by joining fake managed endpoints to the EPM server. When an Ivanti EPM administrator views a poisoned dashboard interface, the malicious JavaScript code is executed, potentially allowing the attacker to gain control of the administrator's session. User interaction is required to trigger the XSS. Ivanti has released EPM version EPM 2024 SU4 SR1 to address this vulnerability.

Description: Stored XSS in Ivanti Endpoint Manager prior to version 2024 SU4 SR1 allows a remote unauthenticated attacker to execute arbitrary JavaScript in the context of an administrator session. User interaction is required.
Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD status: Analyzed
Products: endpoint_manager

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.1
Impact score: 2.7
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Severity: MEDIUM

Weaknesses

3c1d8aa1-5a33-4ea4-8992-aadd6440af75: CWE-79

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "7ABDE6FE-56CC-4A46-91F2-2F54C3EC6A75",
            "versionEndExcluding": "2024",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:-:*:*:*:*:*:*",
            "matchCriteriaId": "6C7283FE-C10A-4E37-B004-15FB0CAC49A5",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su1:*:*:*:*:*:*",
            "matchCriteriaId": "FC51EEA2-1C4C-4069-9704-7ACFE4773930",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su2:*:*:*:*:*:*",
            "matchCriteriaId": "E1EF5E1B-9377-49D3-9BE3-62FC78E666A3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su3:*:*:*:*:*:*",
            "matchCriteriaId": "749AADDA-834D-4EC0-B7FF-E136FD1984F7",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su3_security_release_1:*:*:*:*:*:*",
            "matchCriteriaId": "698BF7A1-62A1-45B5-BF08-AB3F3AA0245C",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:a:ivanti:endpoint_manager:2024:su4:*:*:*:*:*:*",
            "matchCriteriaId": "4902A745-E7CB-4FC9-9BCB-89EFAB643237",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.