CLRF Injection Vulnerability in Ivanti Connect Secure and Policy Secure
CVE-2025-0293

2.7LOW

Key Information:

Vendor

Ivanti
Status
Connect Secure
Policy Secure
Vendor
CVE Published:
8 July 2025

What is CVE-2025-0293?

A CLRF injection vulnerability exists in Ivanti Connect Secure and Ivanti Policy Secure prior to specified versions. This flaw enables remote authenticated attackers, possessing admin rights, to manipulate and modify protected configuration files on disk. Such unauthorized access could potentially compromise the integrity of sensitive configurations, exposing the systems to various security risks.

Affected Version(s)

Connect Secure 22.7R2.8

Policy Secure 22.7R1.5

References

https://forums.ivanti.com/s/article/July-Security-Advisor...

CVSS V3.1

Score:
2.7
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.