Introduction
Remote code execution through a mobile device management platform's admin panel can expose every managed device in an enterprise. CVE-2025-10242 in Ivanti Endpoint Manager Mobile (EPMM) is a recent example. It lets authenticated admin users inject arbitrary operating system commands and take full control of the EPMM server.
Ivanti is a major vendor of unified endpoint management software, and enterprises widely use EPMM to manage and secure mobile devices at scale. The platform is critical infrastructure for organizations in healthcare, finance, government, and other sectors where mobile device security is essential.
Technical Information
CVE-2025-10242 is an OS command injection vulnerability categorized under CWE-78. The flaw is in the admin panel of Ivanti EPMM, which does not properly sanitize user input before passing it to operating system command execution functions. An attacker with valid admin credentials can craft input that injects arbitrary OS commands, and the server executes those commands with the privileges of the EPMM application process.
Only authenticated users with admin privileges can exploit the vulnerability. The specific injection point and the affected parameters have not been described publicly, and no public code snippets or proof of concept have been released. The vulnerability affects EPMM versions prior to 12.6.0.2, 12.5.0.4, and 12.4.0.4.
Affected Systems and Versions
The following versions of Ivanti Endpoint Manager Mobile (EPMM) are affected:
- All versions prior to 12.6.0.2
- All versions prior to 12.5.0.4
- All versions prior to 12.4.0.4
Any EPMM deployment running one of these versions is vulnerable if an attacker can authenticate as an admin user. The vulnerability is in the admin panel component.
Vendor Security History
Ivanti's EPMM and other endpoint management products have had several critical vulnerabilities in recent years. Advanced threat actors, including UNC5221, exploited CVE-2025-4427 and CVE-2025-4428 in the wild. The company has sometimes been criticized for slow patch responses, and the recurring high-severity vulnerabilities point to ongoing problems in its secure development and supply chain management.
