CVE-2024-36131: 
Ivanti Endpoint Manager Mobile vulnerability analysis and mitigation

An insecure deserialization vulnerability was identified in the web component of Ivanti Endpoint Manager for Mobile (EPMM) prior to version 12.1.0.1. The vulnerability, tracked as CVE-2024-36131, was disclosed in July 2024 and affects the web component of EPMM systems (NVD, CERT-EU).

The vulnerability has been assigned a CVSS v3.1 base score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The flaw is categorized as CWE-502 (Deserialization of Untrusted Data) and requires authentication for exploitation (NVD).

If successfully exploited, this vulnerability allows an authenticated remote attacker to execute arbitrary commands on the underlying operating system of the appliance, potentially leading to complete system compromise (CERT-EU).

The vulnerability requires authentication for exploitation, indicating that an attacker would need valid credentials to exploit the flaw. The attack complexity is rated as Low, suggesting that once authenticated, the vulnerability is relatively straightforward to exploit (NVD).

Ivanti has released version 12.1.0.1 to address this vulnerability. Organizations running affected versions of EPMM are strongly advised to upgrade to the latest version as soon as possible (CERT-EU).