PT-2025-1003 · Ivanti · Ivanti Connect Secure+2

Sinsinology

·

Published

2025-01-08

·

Updated

2026-02-27

·

CVE-2025-0282

CVSS v3.1
9.0
VectorAV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.5 Ivanti Policy Secure versions prior to 22.7R1.2 Ivanti Neurons for ZTA gateways versions prior to 22.7R2.3
Description A stack-based buffer overflow in Ivanti Connect Secure, Policy Secure, and ZTA Gateways allows a remote unauthenticated attacker to achieve remote code execution. The vulnerability is being actively exploited by threat actors, including Chinese nation-state actors, to deploy malware and gain unauthorized access to sensitive data. It is estimated that over 33,000 Ivanti instances are exposed worldwide, with the number of vulnerable devices having fallen from 2,048 to 800 in a short period. The vulnerability has been linked to various malware families, including Spawn and DryHook.
Recommendations Ivanti Connect Secure versions prior to 22.7R2.5: Update to version 22.7R2.5 or later to patch the vulnerability. Ivanti Policy Secure versions prior to 22.7R1.2: Update to version 22.7R1.2 or later to patch the vulnerability. Ivanti Neurons for ZTA gateways versions prior to 22.7R2.3: Update to version 22.7R2.3 or later to patch the vulnerability. As a temporary workaround, consider disabling the vulnerable function until a patch is available. Additionally, restrict access to the vulnerable module to minimize the risk of exploitation.

Exploit

Fix

RCE

LPE

Stack Overflow

Out of bounds Read

Memory Corruption

Weakness Enumeration

CWE-121CWE-125CWE-787

Related Identifiers

BDU:2025-00108
BDU:2025-00224
CVE-2025-0282

Affected Products

Ivanti Connect Secure
Ivanti Neurons For Zta Gateways
Ivanti Policy Secure