CISA Adds Five Actively Exploited Vulnerabilities in Advantive VeraCore and Ivanti EPM to KEV List

CVE-2024-13159 is an absolute path traversal vulnerability (CWE-36) in Ivanti Endpoint Manager (EPM) that allows a remote, unauthenticated attacker to leak sensitive information from the server. It is triggered when the EPM server processes attacker-supplied requests containing absolute file-system paths without properly constraining them, letting the attacker retrieve files outside the intended directory. A successful attack discloses arbitrary file contents, which could include configuration or credential material useful for further compromise; the available data describes information disclosure only, not code execution. Any organization running an Ivanti EPM management server, particularly one reachable by untrusted networks, is affected, though the source data does not specify affected version ranges. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-10, indicating confirmed in-the-wild exploitation, and EPSS assigns it a 100% probability of exploitation within 30 days; no public proof-of-concept is known.

Do: Apply the fixed updates identified in Ivanti's security advisory (specific patched versions are not included in the available data), and follow CISA KEV required action: apply vendor mitigations, comply with BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable. Until patched, restrict network access to the EPM management server to trusted networks and review HTTP/server logs for requests referencing absolute file paths that could indicate exploitation.

CVE-2024-4577 is an OS command injection flaw (CWE-78) in Windows-based PHP when it runs in CGI mode, allowing arbitrary code execution on the server. It is triggered when attacker-supplied characters in HTTP requests are mishandled by Windows' character-encoding conversion as the OS invokes php-cgi, letting attackers inject command-line arguments to the PHP interpreter; this bypasses the decade-old fix for CVE-2012-1823. A successful attacker gains the ability to run arbitrary commands and code in the context of the web server. Affected systems are PHP running on Windows through the CGI interface; deployments that do not use PHP-CGI on Windows are not described as affected in the source data. Exploitation is active: the flaw was added to CISA KEV on 2024-06-12 with known ransomware use, and EPSS assigns roughly 100% probability of exploitation within 30 days.

Do: Per the CISA KEV required action, apply mitigations per vendor instructions or discontinue use: upgrade Windows PHP-CGI deployments to a PHP release that fixes CVE-2024-4577 per PHP Group advisories, or stop using CGI mode on Windows (e.g., switch to FastCGI) and apply any vendor-recommended workarounds. Given known ransomware abuse, review web server access logs for exploitation attempts (notably %AD-encoded soft hyphens and injected -d/-s arguments in php-cgi query strings) and prioritize patching internet-facing Windows hosts.

Advantive VeraCore, a warehouse management and order fulfillment platform, contains an unrestricted file upload flaw (CWE-434) in its upload.aspx endpoint that fails to properly restrict what files can be uploaded and where they are stored. A remote attacker with no credentials can abuse the endpoint to write files into unintended, attacker-influenced folders on the server. By placing crafted files (for example, script files) into web-reachable directories, an attacker can typically escalate an arbitrary upload into webshell deployment and code execution on the hosting server. Any organization running VeraCore, especially instances with the upload endpoint reachable from the internet, is exposed. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-10, indicating active exploitation, and EPSS assigns a 32.3% probability of exploitation within 30 days (98th percentile).

Do: Apply the mitigations required under CISA KEV/BOD 22-01, following Advantive's instructions, and contact the vendor for the fixed release since no patched version is specified in the available data. In the interim, restrict network access to upload.aspx (allow only trusted users or VPN/internal traffic), enforce file-type and destination validation at a WAF/reverse proxy where possible, and hunt for unexpected or recently modified files in VeraCore's web directories plus suspicious entries in web access logs to detect webshells or uploaded payloads.