Ivanti Connect Secure up to 22.7 stack-based overflow

Summaryinfo

A vulnerability has been found in Ivanti Connect Secure, Policy Secure and Neurons for ZTA gateways up to 22.7 and classified as critical. Impacted is an unknown function. The manipulation leads to stack-based overflow. This vulnerability is uniquely identified as CVE-2025-0282. The attack is possible to be carried out remotely. Moreover, an exploit is present. The affected component should be upgraded.

Detailsinfo

A vulnerability was found in Ivanti Connect Secure, Policy Secure and Neurons for ZTA gateways up to 22.7 and classified as critical. This issue affects an unknown part. The manipulation with an unknown input leads to a stack-based overflow vulnerability. Using CWE to declare the problem leads to CWE-121. A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function). Impacted is confidentiality, integrity, and availability. The summary by CVE is:

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

It is possible to read the advisory at forums.ivanti.com. The identification of this vulnerability is CVE-2025-0282 since 01/06/2025. The exploitation is known to be difficult. The attack may be initiated remotely. No form of authentication is needed for a successful exploitation. Technical details are unknown but a public exploit is available.

The exploit is available at cisa.gov. It is declared as attacked. The vulnerability scanner Nessus provides a plugin with the ID 213570 (Ivanti Policy Secure 22.7R1 <= 22.7R1.2 Remote Code Execution (CVE-2025-0282)), which helps to determine the existence of the flaw in a target environment. The CISA Known Exploited Vulnerabilities Catalog lists this issue since 01/08/2025 with a due date of 01/15/2025:

Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (52213), 0day.today (39875), Zero-Day.cz (947) and Tenable (213570). tenable.com is providing further details. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Ivanti

Name

• Connect Secure
• Neurons for ZTA gateways
• Policy Secure

Version

• 22.0
• 22.1
• 22.2
• 22.3
• 22.4
• 22.5
• 22.6
• 22.7

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion