CVE-2025-43716 - CVE House
Back to Database
Status published Medium CVE-2025-43716

A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway...

Vulnerability Description

A directory traversal vulnerability exists in Ivanti LANDesk Management Gateway through 4.2-1.9. By appending %3F.php to the URI of the /client/index.php endpoint, an attacker can bypass access controls and gain unauthorized access to various endpoints such as /client/index.php%3F.php/gsb/firewall.php within the management web panel, potentially exposing sensitive device information. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-43716

Credits & Attribution

No credits recorded in the NVD database.

References

More from Ivanti

View All →
CVE-2025-9872
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3...
High 8.8
CVE-2025-9713
Path traversal in Ivanti Endpoint Manager before version 2024 SU4...
High 8.8
CVE-2025-9712
Insufficient filename validation in Ivanti Endpoint Manager before 2024 SU3...
High 8.8
CVE-2025-8712
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2,...
Medium 5.4
CVE-2025-8711
CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti...
Medium 5.4

Affected Vendor

Affected Software

LANDesk Management Suite
Vulnerable Versions:
0

Timeline

Official Publish: April 23rd, 2025
Last Modified: April 23rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

Weaknesses (CWE)

CWE-180

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.