CVE-2025-10573 - Ivanti EPM Stored XSS Enables Admin Session Hijack
CORTEX Protocol Intelligence Assessment
Business Impact: Endpoint management platform compromise gives attackers control over every managed device—install software, disable antivirus, exfiltrate data, deploy ransomware. Unauthenticated attack vector means any network-accessible EPM instance is vulnerable. MFA bypass through session hijacking means traditional authentication controls ineffective. Technical Context: CVE-2025-10573 is stored cross-site scripting in Ivanti EPM incomingdata API endpoint (T1059.007 JavaScript, T1185 Browser Session Hijacking). Attackers POST malicious payloads to /incomingdata/postcgi.exe without authentication. Payloads stored in device database render unsanitized in admin dashboard (frameset.aspx, db_frameset.aspx). When admin views infected page, JavaScript executes, steals session cookies, grants full admin access.
Strategic Intelligence Guidance
- Upgrade all Ivanti Endpoint Manager installations to version 2024 SU4 SR1 or later on an emergency basis, prioritizing systems reachable from outside dedicated admin networks.
- Restrict access to the EPM web interface using VPN, IP allowlists and strong authentication, and avoid exposing /incomingdata/postcgi.exe to untrusted networks.
- Monitor for suspicious device registrations, unusual endpoint names, and anomalous administrative actions that could indicate stored XSS exploitation and admin session hijacking.
- Incorporate unauthenticated API endpoints such as incomingdata into application security testing and code review processes, ensuring input validation and output encoding for user-controlled fields.