CVE-2023-28323: 
Ivanti Endpoint Manager vulnerability analysis and mitigation

A critical vulnerability identified as CVE-2023-28323 affects Ivanti Endpoint Manager (EPM) versions 2022 SU3 and all prior versions. The vulnerability was discovered and disclosed in June 2023, with Ivanti releasing a security advisory on June 20, 2023 (Ivanti Blog).

The vulnerability is a deserialization of untrusted data flaw that exists within the ProcessEPMAuthToken method. It has received a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. The issue stems from the lack of proper validation of user-supplied data, which can result in deserialization of untrusted data, classified as CWE-502 (NVD, ZDI).

The vulnerability allows remote attackers to execute arbitrary code on affected installations of Ivanti Endpoint Manager without requiring authentication. An attacker can leverage this vulnerability to execute code in the context of NETWORK SERVICE and potentially escalate privileges on the machine or use it as a stepping stone to access other network-attached machines (ZDI).

Ivanti has released a patch to address this vulnerability. All future Service Updates (SU) starting with version 2022 SU4 have the fix already applied. Affected customers are strongly advised to apply the available patch (Ivanti Blog).