# CVE-2025-4428: Ivanti EMM - RCE

> Live exploitation tracking for CVE-2025-4428 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-4428

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 7.2
- **Public exploit available:** Yes
- **Affected products:** Ivanti Endpoint Manager Mobile
- **Weaknesses:** CWE-94 (Improper Control of Generation of Code ('Code Injection'))
- **Tags:** sslvpn

## Description

Remote Code Execution in API component in Ivanti Endpoint Manager Mobile 12.5.0.0 and prior on unspecified platforms allows authenticated attackers to execute arbitrary code via crafted API requests.

## CrowdSec analysis

[CVE-2025-4428](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-4428) is a vulnerability affecting Ivanti Endpoint Manager Mobile, where attackers with access can achieve remote code execution by submitting crafted API requests to a specific endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 21st of May 2025.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2025-4428 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
Data from the CrowdSec community also indicates a gradual decrease in attacks targeting CVE-2025-4428. While still present in the wild, exploitation levels have dropped noticeably week-over-week. This may signal that the vulnerability is becoming less relevant or that defenses are improving fast enough for attackers to lose interest.

Observed attack patterns specifically target URLs containing `/mifs/rs/api/v2/featureusage`.

## Timeline

- 2025-05-13: CVE Published. CVE-2025-4428 is published to NVD.
- 2025-05-19: CISA KEV. CVE-2025-4428 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-05-21: Rule Released. CrowdSec releases a rule to detect CVE-2025-4428 exploitation attempts against the CrowdSec Network.
- 2025-05-22: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-4428 for the first time.
- 2025-06-09: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428
- https://nvd.nist.gov/vuln/detail/cve-2025-4428

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-4428) follows observed exploitation activity for CVE-2025-4428. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.