Missing Authorization in Ivanti Connect Secure and Related Products
CVE-2025-55144

5.4MEDIUM

Key Information:

Vendor

Ivanti
Status
Connect Secure
Policy Secure
Zta Gateway
Neurons For Secure Access
Vendor
CVE Published:
9 September 2025

What is CVE-2025-55144?

Ivanti Connect Secure and its associated products have a missing authorization vulnerability that allows a remote authenticated attacker with read-only admin privileges to modify restricted settings. This flaw affects versions prior to the specified updates and poses a significant risk if exploited, as it enables unauthorized configuration changes by malicious actors.

Affected Version(s)

Connect Secure 22.7R2.9

Neurons for Secure Access 22.8R1.4 (Fix deployed on 02-Aug-2025)

Policy Secure 22.7R1.6

References

https://forums.ivanti.com/s/article/September-Security-Ad...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.