An authentication bypass in the API component of Ivanti Endpoint Manager Mobile 12.5.0.0 and prior

CVE-2025-4427 is an authentication bypass in Ivanti Endpoint Manager Mobile (EPMM, formerly MobileIron) versions 12.5.0.0 and prior, including branches 12.4.x, 12.3.x, and 11.12.x. The flaw exists because Spring Security's <intercept-url> rules are missing for the /mifs/rs/api/v2/ route prefix, meaning bean validation on endpoints like /rs/api/v2/featureusage executes before authentication is enforced. By itself the bypass exposes only limited read access — hence the vendor's CVSS 5.3. But it chains trivially with CVE-2025-4428**, a Java Expression Language injection in DeviceFeatureUsageReportQueryRequestValidator, turning one unauthenticated GET request into full remote code execution as the EPMM service account.

Ivanti's MEDIUM 5.3 score for this CVE is indefensible in practice. The authentication bypass is the gate to a weaponized RCE chain that has been actively exploited by a China-nexus espionage group since at least May 15, 2025. CISA added both CVEs to KEV on May 19, 2025 and released a dedicated malware analysis report on September 18, 2025. EPSS sits at 0.99927 — the 99.9th percentile. Public Metasploit modules, Nuclei templates, and Python PoCs exist. Compromised EPMM instances have yielded LDAP credentials, Office 365 tokens, device IMEIs, phone numbers, and location data for entire mobile fleets. Scoring this chain as anything less than CRITICAL ignores how MDM platforms sit at the center of enterprise mobile trust.

1. Patch immediately to 12.5.0.1, 12.4.0.2, 12.3.0.2, or 11.12.0.5 — This is the only complete fix. Given CRITICAL verdict and active exploitation, the noisgate mitigation SLA demands action within 3 days. The noisgate remediation SLA is 90 days, but with KEV listing and active exploitation, treat patching as the immediate mitigation — do not wait.
2. Restrict network access to EPMM management API — If you cannot patch within hours, place a WAF or reverse proxy rule blocking access to /mifs/rs/api/v2/featureusage and /mifs/rs/api/v2/featureusage_history from all sources except trusted management IPs. Mobile device enrollment uses different endpoints. Deploy within 3 days per noisgate mitigation SLA.
3. Deploy WAF rules blocking EL injection patterns — Block query parameters containing ${ and Java reflection patterns (getClass, forName, getRuntime, exec) in the format parameter. Emerging Threats IDS signatures are already available. This is defense-in-depth, not a substitute for patching.
4. Audit EPMM for indicators of compromise — Check for JSP files in /mifs/ webroot (especially 401.jsp, css/css.css, session.jsp, baseURL.jsp). Search for unexpected processes spawned by Tomcat. Review MySQL query logs for mysqldump of mifs_ldap_server_config or mifs_ldap_users. Check /tmp/ for KrustyLoader artifacts. Compare against IOCs from CISA AR25-261a and EclecticIQ reporting.
5. Rotate LDAP bind credentials and O365 tokens — If your EPMM instance was unpatched and internet-facing at any point since May 13, 2025, assume the LDAP bind credentials stored in the mifs database are compromised. Rotate immediately. Revoke and reissue any Office 365 OAuth tokens managed through EPMM.
6. Monitor for lateral movement from EPMM network segment — EPMM appliances typically have LDAP/AD connectivity. Watch for authentication attempts using EPMM's LDAP bind account from unexpected sources. Enable enhanced AD audit logging for the service account.

Run this script on the EPMM appliance itself (or any host with curl and network access to the target). Execute as: bash check_cve_2025_4427.sh https://epmm.example.com. No special privileges required — it only sends an HTTP GET request and parses the response.

#!/usr/bin/env bash
# check_cve_2025_4427.sh — Detect CVE-2025-4427 authentication bypass in Ivanti EPMM
# Usage: bash check_cve_2025_4427.sh <EPMM_BASE_URL>
# Exit codes: 0=VULNERABLE, 1=PATCHED, 2=UNKNOWN

set -euo pipefail

if [[ $# -lt 1 ]]; then
  echo "Usage: $0 <EPMM_BASE_URL>"
  echo "Example: $0 https://epmm.example.com"
  exit 2
fi

BASE_URL="${1%/}"
TEST_URL="${BASE_URL}/mifs/rs/api/v2/featureusage?format=noisgate_probe"

echo "[*] Testing CVE-2025-4427 auth bypass on: ${BASE_URL}"
echo "[*] Sending unauthenticated request to /mifs/rs/api/v2/featureusage"

HTTP_CODE=$(curl -sk -o /tmp/cve_2025_4427_resp.txt -w '%{http_code}' \
  --connect-timeout 10 --max-time 15 \
  "${TEST_URL}" 2>/dev/null || echo "000")

RESP_BODY=$(cat /tmp/cve_2025_4427_resp.txt 2>/dev/null || echo "")
rm -f /tmp/cve_2025_4427_resp.txt

echo "[*] HTTP response code: ${HTTP_CODE}"

if [[ "${HTTP_CODE}" == "000" ]]; then
  echo "UNKNOWN — Could not connect to ${BASE_URL}"
  exit 2
fi

# Patched instances return 401/403 for unauthenticated API access
# Vulnerable instances return 400 with validation error containing the format value
if [[ "${HTTP_CODE}" == "400" ]] && echo "${RESP_BODY}" | grep -qi "noisgate_probe"; then
  echo "VULNERABLE — Server processed unauthenticated request and reflected format parameter."
  echo "[!] CVE-2025-4427 authentication bypass confirmed. The format value was reflected"
  echo "    in validation error, confirming CVE-2025-4428 EL injection surface is reachable."
  echo "[!] Patch immediately to 12.5.0.1 / 12.4.0.2 / 12.3.0.2 / 11.12.0.5"
  exit 0
elif [[ "${HTTP_CODE}" == "401" ]] || [[ "${HTTP_CODE}" == "403" ]]; then
  echo "PATCHED — Server returned ${HTTP_CODE} (authentication enforced)."
  exit 1
elif [[ "${HTTP_CODE}" == "400" ]]; then
  # 400 without reflection may indicate partial patch or different config
  if echo "${RESP_BODY}" | grep -qi "format"; then
    echo "VULNERABLE — Server returned 400 with format-related error without authentication."
    exit 0
  else
    echo "UNKNOWN — Server returned 400 but response is ambiguous. Manual review needed."
    echo "Response preview: ${RESP_BODY:0:200}"
    exit 2
  fi
elif [[ "${HTTP_CODE}" == "404" ]]; then
  echo "UNKNOWN — Endpoint not found. Verify this is an EPMM instance."
  exit 2
else
  echo "UNKNOWN — Unexpected HTTP ${HTTP_CODE}. Manual review recommended."
  echo "Response preview: ${RESP_BODY:0:200}"
  exit 2
fi

1. Ivanti Security Advisory — EPMM May 2025
2. watchTowr Labs — Expression Payloads Meet Mayhem (Root Cause + PoC)
3. Wiz Threat Research — EPMM RCE Chain Exploited in the Wild
4. EclecticIQ — China-Nexus Threat Actor Exploiting EPMM
5. Rapid7 — Ivanti EPMM Exploit Chain Exploited in the Wild
6. CISA Malware Analysis Report AR25-261a
7. Censys Advisory — EPMM Chained Exploits KEV
8. GreyNoise — Ivanti EPMM Zero-Days: Reconnaissance to Exploitation