Description
在Ivanti Endpoint Manager Mobile 12.5.0.0及之前版本的API组件中发现了一个远程代码执行漏洞。该漏洞允许经过身份验证的攻击者通过发送精心构造的API请求，利用Java反射机制执行任意代码，可能导致服务器被完全控制。
Ivanti Endpoint Manager Mobile API /api/v2/featureusage 代码执行漏洞（CVE-2025-4428）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2025-4428
https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Endpoint-Manager-Mobile-EPMM
https://projectdiscovery.io/blog/ivanti-remote-code-execution
https://www.wiz.io/blog/ivanti-epmm-rce-vulnerability-chain-cve-2025-4427-cve-2025-4428
https://www.darktrace.com/blog/ivanti-under-siege-investigating-the-ivanti-endpoint-manager-mobile-vulnerabilities-cve-2025-4427-cve-2025-4428
https://blog.eclecticiq.com/china-nexus-threat-actor-actively-exploiting-ivanti-endpoint-manager-mobile-cve-2025-4428-vulnerability
https://www.tenable.com/blog/cve-2025-4427-cve-2025-4428-ivanti-endpoint-manager-mobile-epmm-remote-code-execution
https://www.cve.org/CVERecord?id=CVE-2025-4428
https://labs.watchtowr.com/expression-payloads-meet-mayhem-cve-2025-4427-and-cve-2025-4428/
https://github.com/watchtowrlabs/watchTowr-vs-Ivanti-EPMM-CVE-2025-4427-CVE-2025-4428