What is CVE-2023-35082?

A critical vulnerability, CVE-2023-35082, has been identified in Ivanti Endpoint Manager Mobile (EPMM) up to and including version 11.10.0. It affects systems running Ivanti EPMM and MobileIron Core, posing a significant risk to the security of these systems. Users and organizations are urged to take necessary precautions to mitigate the risk associated with this vulnerability.

Who is impacted by this?

The CVE-2023-35082 vulnerability affects users of Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core up to and including version 11.10. Specifically, it impacts users of MobileIron Core version 11.2 and prior, as well as Ivanti EPMM versions 11.10, 11.9, 11.8, and MobileIron Core 11.7 and below.

What should I do if I’m affected?

If you're affected by the CVE-2023-35082 vulnerability, it's crucial to take immediate action to secure your systems. Follow these simple steps to mitigate the risk:

1. Upgrade to Ivanti Endpoint Manager Mobile (EPMM) version 11.11.0.0, which has patched the vulnerability.

2. If you're using EPMM versions 11.10 to 11.3, apply the RPM script provided by Ivanti for mitigation. Users on older versions should first upgrade to 11.10 and then apply the script.

3. Consider alternative mitigation techniques, such as isolation, to minimize direct access to critical software and data.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-35082 vulnerability, also known as Ivanti Endpoint Manager Mobile (EPMM) and MobileIron Core Authentication Bypass Vulnerability, is indeed present in CISA's Known Exploited Vulnerabilities Catalog. It was added on January 18, 2024, and the due date for taking action is February 8, 2024.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-287, which refers to improper authentication in Ivanti EPMM and MobileIron Core.

Learn More

To better understand its impact and mitigation strategies, refer to the NVD page and the sources listed below.

• Ivanti's advisory

• CISA's BOD 22-01

• CISA's Known Exploited Vulnerabilities Catalog