Endpoint manager mobile - RCE (CVE-2025-4428)

CVE-2025-4428 is a vulnerability affecting Ivanti Endpoint Manager Mobile, where attackers with access can achieve remote code execution by submitting crafted API requests to a specific endpoint.

CrowdSec has been tracking this vulnerability and its exploits since 21st of May 2025.

CrowdSec network observations suggest that most exploitation of CVE-2025-4428 involves focused reconnaissance to identify viable targets. Attackers typically tailor their campaigns based on system exposure and configuration. It is unlikely that a given attack is accidental. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-4428 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-4428 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.

Observed attack patterns specifically target URLs containing /mifs/rs/api/v2/featureusage.