CVE-2025-43716 is a directory traversal vulnerability identified in Ivanti LANDesk Management Suite versions up to 4.2-1.9, specifically affecting the LANDesk Management Gateway component. The vulnerability arises from improper input validation and ordering of validation and canonicalization processes (CWE-180: Incorrect Behavior Order: Validate Before Canonicalize). By appending the encoded string '%3F.php' to the URI of the /client/index.php endpoint, an attacker can bypass access control mechanisms and access unauthorized endpoints within the management web panel. For example, accessing /client/index.php%3F.php/gsb/firewall.php allows the attacker to reach sensitive internal endpoints that should be restricted. This can lead to exposure of sensitive device information managed by the suite. The vulnerability is notable because it exploits a subtle flaw in how the application processes and normalizes input paths before validating them, allowing crafted requests to circumvent security checks. It is important to note that this vulnerability affects only versions of the product that are no longer supported by Ivanti, and no official patches or mitigations have been released by the vendor. There are no known exploits in the wild at this time, but the vulnerability's nature makes it a potential target for attackers seeking to gather sensitive information from managed devices. The lack of vendor support increases the risk for organizations still running these legacy versions, as they cannot rely on official fixes or updates.

For European organizations using unsupported versions of Ivanti LANDesk Management Suite, this vulnerability poses a moderate risk. Successful exploitation can lead to unauthorized access to internal management endpoints, potentially exposing sensitive device configurations, firewall settings, and other critical management data. This exposure could facilitate further attacks such as lateral movement within the network, reconnaissance, or targeted exploitation of managed devices. While the vulnerability does not directly enable remote code execution or system takeover, the confidentiality and integrity of management data are at risk. Organizations in sectors with stringent data protection requirements (e.g., finance, healthcare, critical infrastructure) could face compliance issues if sensitive information is leaked. Additionally, the exposure of device management details could weaken overall security posture, increasing susceptibility to subsequent attacks. Since the affected product is a management suite, the scope of impact depends on the extent of deployment within the organization. The lack of vendor support means organizations cannot expect patches, increasing the urgency for alternative mitigations. Given the medium severity and no known active exploitation, the immediate risk is moderate but could escalate if exploits emerge.

Given the absence of vendor patches for unsupported versions, European organizations should prioritize the following specific mitigations: 1) Upgrade or migrate to a supported version or alternative product that does not have this vulnerability. If upgrading is not immediately feasible, consider isolating the LANDesk Management Gateway from direct internet exposure and restrict access to trusted internal networks only. 2) Implement strict network segmentation and firewall rules to limit access to the management web panel endpoints, ensuring only authorized administrators can reach these interfaces. 3) Deploy Web Application Firewalls (WAFs) with custom rules to detect and block requests containing suspicious patterns such as '%3F.php' appended to URIs targeting /client/index.php. 4) Conduct regular security audits and monitoring of web server logs for anomalous access attempts that may indicate exploitation attempts. 5) Employ intrusion detection/prevention systems (IDS/IPS) tuned to detect directory traversal and path manipulation attacks. 6) Enforce strong authentication and multi-factor authentication for access to management interfaces to reduce risk even if access control bypass is attempted. 7) Document and maintain an inventory of all Ivanti LANDesk Management Suite deployments to identify and prioritize vulnerable instances for remediation. These measures go beyond generic advice by focusing on compensating controls tailored to the specific vulnerability and product context.