CVE-2025-43716: ivanti landesk_management_suite
Vulnerability summary
CVE-2025-43716 is a medium (CVSS 5.8) vulnerability in ivanti landesk_management_suite. EPSS estimates a 1.21% chance of exploitation in the next 30 days, higher than 68.1% of scored vulnerabilities.
Timeline
- 23-04-2025PublishedVulnerability first disclosed.
- 23-04-2025Last modifiedVulnerability information updated.
Description
A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /client/index.php endpoint, an attacker can bypass access controls and gain unauthorized access to various endpoints such as /client/index.php%3F.php/gsb/firewall.php within the management web panel, potentially exposing sensitive device information. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST5.8MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N
EPSS trend
Probability
1.21%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
No change 0.00 pp
From 1.21% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Ivanti1 product
- landesk_management_suite≤ 4.2-1.9
1 vendor · 1 product