Improper Access Control in Ivanti Connect Secure and Policy Secure
CVE-2025-5450

6.3MEDIUM

Key Information:

Vendor

Ivanti
Status
Connect Secure
Policy Secure
Vendor
CVE Published:
8 July 2025

What is CVE-2025-5450?

Improper access control has been identified in the certificate management component of Ivanti Connect Secure and Ivanti Policy Secure prior to their respective version updates. This vulnerability allows a remote authenticated administrator with read-only access to inadvertently modify settings that should be restricted, potentially compromising the integrity and security of the systems involved. Organizations are recommended to update to the latest versions to mitigate this risk.

Affected Version(s)

Connect Secure 22.7R2.8

Policy Secure 22.7R1.5

References

https://forums.ivanti.com/s/article/July-Security-Advisor...

CVSS V3.1

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.