id: CVE-2025-4428

info:
  name: "Ivanti Endpoint Manager Mobile - Code Injection"
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified
    platforms allows authenticated attackers to execute arbitrary code via crafted API requests.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-4428&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=ivanti&match=exact
  classification:
    cve-id: CVE-2025-4428
  metadata:
    verified: false
  tags: cve,cve2025,kev,ivanti,code-injection,rce
http:
  - method: GET
    path:
      - "{{BaseURL}}/mics/login.jsp"

    extractors:
      - type: regex
        name: version
        group: 1
        regex:
          - '<div[^>]*class="[^"]*product-version[^"]*"[^>]*>\s*([0-9.]+)\s*</div>'

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "Ivanti System Manager"

      - type: status
        status:
          - 200

      - type: dsl
        dsl:
          - compare_versions(version, "< 12.5")