Ivanti Avalanche SmartDeviceServer DeviceLogsManager 目录遍历漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://software.sonicwall.com/applications/ips/index.asp?ev=sig&sigid=3054
• https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.TCP:C2S:IVANTI-SER-DIR.html
• https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/7.19.51_s.pdf
• https://autoupdate.ngfw.forcepoint.com/download/dynup/sgpkg-1983-SUMMARY.html

Related Vulnerabilities

• PoCCVE-2026-1281: Ivanti EPMM <=12.7.0.0 - Unauthenticated Code Injection
• PoCCVE-2026-10520: Ivanti Sentry - OS Command Injection
• Ivanti Sentry存在操作系统命令注入漏洞(CVE-2026-10520)
• Ivanti Sentry /mics/api/v2/sentry/mics-config/handleMessage 命令执行漏洞（CVE-2026-10520）
• Ivanti EPMM /mifs/rs/api/v2/featureusage 命令执行漏洞（CVE-2025-4427）
• PoCIvanti Endpoint Manager /RemoteControlAuth/api/Auth 权限绕过漏洞（CVE-2026-1603）
• Ivanti Endpoint Manager 权限管理不当漏洞
• PoCCVE-2026-1603: Ivanti Endpoint Manager - Authentication Bypass
• Ivanti Endpoint Manager Mobile /mifs/c/appstore/fob/3/5/sha256 命令执行漏洞（CVE-2026-1281/CVE-2026-1340）
• Ivanti Endpoint Manager Mobile 未授权 代码注入漏洞
• Ivanti多个产品跨站请求伪造漏洞(CVE-2025-8711)
• （CVE-2025-8712）Ivanti产品权限验证不足漏洞