CVE-2024-13166 | Vulnetix

CVE-2024-13166 PUBLISHED CVSS 7.5 HIGH

Reported by ivanti · Published January 14, 2025

An out-of-bounds write in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote unauthenticated attacker to cause a denial of service.

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

Package	Ecosystem	Fixed in
endpoint_manager	ivanti	2022

Risk scores

CVSS 3.1

7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected products

Vendor	Product	Versions
Ivanti	Endpoint Manager	2024 January-2025 Security Update, 2022 SU6 January-2025 Security Update
Ivanti	Endpoint Manager	*

Timeline

Jan 14, 2025 CVE Published
Jan 14, 2025 PoC Published (2 in total, the first dated here)
Jan 15, 2025 EPSS Score (30 in total, the first dated here)
Apr 2, 2025 Coalition ESS Score (8 in total, the first dated here)
Sep 9, 2025 Nuclei Template
Sep 9, 2025 Fix Commit
Jan 20, 2026 CVE Updated
Jun 2, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln CVE-2024-13166
vulnetix vdb fixes CVE-2024-13166

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/CVE-2024-13166/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →