CVE-2025-0282
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Lifecycle Timeline
4Tags
Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
Analysis
Ivanti Connect Secure, Policy Secure, and Neurons for ZTA contain a stack-based buffer overflow allowing unauthenticated remote code execution, the second major Ivanti VPN zero-day in twelve months.
Technical Context
The CWE-121 stack-based buffer overflow in the VPN appliance's request processing allows unauthenticated attackers to overwrite the stack and achieve code execution. The direct memory corruption attack doesn't require authentication or chaining with other vulnerabilities.
Affected Products
['Ivanti Connect Secure before 22.7R2.5', 'Ivanti Policy Secure before 22.7R1.2', 'Ivanti Neurons for ZTA gateways before 22.7R2.3']
Remediation
Apply Ivanti security updates. Consider migrating to alternative VPN solutions given the repeated critical vulnerabilities. Factory reset before patching. Rotate all credentials.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today