PT-2025-14768 · Ivanti · Ivanti Connect Secure +2

Published

2025-04-03

·

Updated

2025-07-15

·

CVE-2025-22457

CVSS v3.1
9.8
VectorAV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions:**

Ivanti Connect Secure versions 22.7R2.5 and earlier

Ivanti Policy Secure versions 22.7R1.4 and earlier

Ivanti ZTA Gateways versions 22.8R2.2 and earlier

**Description:**

A stack-based buffer overflow vulnerability exists in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. This vulnerability allows a remote, unauthenticated attacker to achieve remote code execution. The vulnerability was initially misdiagnosed as a low-risk issue but has been actively exploited by UNC5221, a suspected China-nexus threat actor, since mid-March 2025. Exploitation involves the use of malware families including TRAILBLAZE, BRUSHFIRE, and SPAWN. Over 5,000 Ivanti Connect Secure appliances are estimated to be vulnerable.

The vulnerability is triggered by manipulating the `X-Forwarded-For` header, leading to a buffer overflow in the HTTP(S) web server component.

**Recommendations:**

Ivanti Connect Secure versions prior to 22.7R2.6

Ivanti Policy Secure versions prior to 22.7R1.4

Ivanti ZTA Gateways versions prior to 22.8R2.2

Exploit

Fix

RCE

DoS

Memory Corruption

Stack Overflow

Weakness Enumeration

CWE-787CWE-121

Related Identifiers

BDU:2025-03788
CVE-2025-22457

Affected Products

Ivanti Connect Secure
Ivanti Policy Secure
Ivanti Zta Gateways