Stack-Based Buffer Overflow in Ivanti Connect Secure and Policy Secure
CVE-2025-0282

9CRITICAL

Key Information:

Vendor
Ivanti
Status
Connect Secure
Policy Secure
Neurons For Zta Gateways
Vendor
CVE Published:
8 January 2025

Badges

🔥 Trending now🥇 Trended No. 1📈 Trended📈 Score: 30,900💰 Ransomware👾 Exploit Exists🟡 Public PoC🦅 CISA Reported📰 News Worthy

What is CVE-2025-0282?

CVE-2025-0282 is a critical vulnerability affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways. These products are designed to provide secure access to enterprise applications and resources. This specific vulnerability is a stack-based buffer overflow that could allow a remote, unauthenticated attacker to execute arbitrary code on affected systems. If exploited, this flaw poses a serious risk to organizations as it could potentially lead to unauthorized access to sensitive data and disruption of services.

Technical Details

The vulnerability resides in the code handling within Ivanti’s secure access technologies. Versions prior to 22.7R2.5 for Connect Secure, 22.7R1.2 for Policy Secure, and 22.7R2.3 for Neurons for ZTA gateways are affected. The stack-based buffer overflow leaves the system open to malicious input that can manipulate execution flow, enabling an attacker to run arbitrary commands remotely. This flaw underscores the importance of proper input validation and memory management in software development to prevent similar vulnerabilities.

Potential Impact of CVE-2025-0282

  1. Remote Code Execution: An attacker could exploit the vulnerability to run arbitrary code on the affected devices, leading to complete control over the system.

  2. Data Breaches: Unauthorized access could result in the exposure and theft of sensitive data, impacting organizational confidentiality and compliance with data protection regulations.

  3. Service Disruption: Successful exploitation could allow attackers to manipulate or disrupt services, leading to downtime and loss of operational capabilities, which can be particularly damaging for businesses relying on seamless access to secure applications.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.

The CISA's recommendation is: Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

Affected Version(s)

Connect Secure 22.7R2 <= 22.7R2.4

Neurons for ZTA gateways 22.7R2 <= 22.7R2.3

Policy Secure 22.7R1 <= 22.7R1.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2025-0282-Ivanti-exploit
Created by absholi7ly

News Articles

favicon imageCybersecurityNews

33,542 Ivanti Connect Secure Instances Exposed as Exploitation of CVE-2025-0282 Unfolds

A critical security vulnerability, CVE-2025-0282, has been identified and exploited in the wild, affecting Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways.

2 days ago

favicon imagewatchTowr Labs

Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE (CVE-2025-0282)

As we saw in our previous blogpost, we fully analyzed Ivanti’s most recent unauthenticated Remote Code Execution vulnerability in their Connect Secure (VPN) appliance. Specifically, we analyzed CVE-2025-0282. Today, we’re going to walk through exploitation. Once again, however, stopping short of pr...

2 days ago

favicon imageThe Hacker News

Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect Secure and Policy Secure

Ivanti's CVE-2025-0282 flaw, exploited by China-linked actors, enables remote code execution. CISA demands urgent patching by January 15, 2025.

4 days ago

References

https://forums.ivanti.com/s/article/Security-Advisory-Iva...

EPSS Score

1% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • 🟡

    Public PoC available

  • 🥇

    Vulnerability reached the number 1 worldwide trending spot

  • 💰

    Used in Ransomware

  • 📈

    Vulnerability started trending

  • 📰

    First article discovered by Help Net Security

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.