CVE-2025-0282

What it actually does

CVE-2025-0282 is a pre-authentication stack-based buffer overflow in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways. A remote unauthenticated attacker can send a crafted request to the vulnerable appliance and corrupt stack memory, allowing control of execution flow and remote code execution on the device. Because these products commonly sit at the network edge and broker VPN or zero-trust access, successful exploitation can give an attacker code execution on a highly trusted perimeter system before any login occurs.

Why it matters to the business

This is a critical perimeter-device vulnerability with confirmed exploitation in the wild, extremely high EPSS likelihood, CISA KEV listing, and documented ransomware use. Compromise can lead to stolen VPN credentials, unauthorized remote access, persistent backdoors, internal reconnaissance, data theft, service disruption, and ransomware deployment. The CISA remediation deadline of 2025-01-15 has passed, so any still-vulnerable internet-facing appliance should be treated as an urgent incident risk, not routine patching.

How an attack unfolds

An attacker identifies an exposed Ivanti Connect Secure, Policy Secure, or Neurons for ZTA gateway running a vulnerable release. Without authenticating, the attacker sends a specially crafted request that triggers the stack buffer overflow. The overflow corrupts memory and redirects execution to attacker-controlled code, resulting in remote command execution on the appliance. After gaining execution, the attacker may deploy web shells or implants, steal credentials and session material, modify or delete logs, interfere with integrity checks or upgrades, and establish outbound command-and-control. Because the appliance is a trusted access gateway, the attacker can then pivot into internal systems using stolen credentials or the appliance’s network position. Public reporting places this vulnerability in active H1 2025 exploitation activity, including ransomware-associated campaigns.

How to fix it

Upgrade immediately to a fixed version or later: Ivanti Connect Secure 22.7R2.5 or later, Ivanti Policy Secure 22.7R1.2 or later, and Ivanti Neurons for ZTA gateways 22.7R2.3 or later. If the appliance was internet-facing while vulnerable, assume possible compromise until investigated. Run Ivanti’s internal and external Integrity Checker Tool where applicable, review vendor advisories, and follow Ivanti’s recommended recovery process. If compromise is suspected or integrity checks fail, rebuild or factory-reset the appliance from a trusted image rather than relying only on an in-place upgrade. Rotate local and directory-integrated credentials, API keys, certificates, private keys, SAML/OIDC secrets, service-account passwords, and invalidate active VPN/ZTA sessions. Restrict appliance management interfaces to trusted administrative networks, reduce unnecessary internet exposure, and monitor outbound traffic from the appliance.

How to confirm the fix worked

Confirm every affected appliance reports a fixed or later version: Connect Secure 22.7R2.5+, Policy Secure 22.7R1.2+, or Neurons for ZTA gateway 22.7R2.3+. Validate through the administrative interface, vendor-supported CLI or inventory tooling, and vulnerability scanning where safe. Run the vendor integrity checker and confirm no unexpected file additions, modifications, or mismatches are reported. Verify that management interfaces are not exposed broadly to the internet and that only required service ports are reachable. Confirm that all sessions, credentials, certificates, and federation secrets associated with the appliance have been rotated if exposure existed before patching. Review post-upgrade logs to ensure upgrades completed successfully and were not blocked, reverted, or simulated by malicious tampering.

Typical attack path

1. Scan the internet for exposed Ivanti Connect Secure, Ivanti Policy Secure, or Ivanti Neurons for ZTA gateways.
2. Fingerprint the appliance version or behavior to identify vulnerable releases.
3. Send a crafted unauthenticated request that triggers the stack-based buffer overflow.
4. Achieve remote code execution in the context of the vulnerable appliance process.
5. Run commands to enumerate the appliance, dump configuration, and collect credentials, tokens, certificates, or session data.
6. Deploy persistence such as a web shell, reverse shell, tunneling tool, or modified appliance file.
7. Tamper with logs, integrity artifacts, or upgrade behavior to delay detection.
8. Use the appliance’s trusted network access to move laterally, steal data, or support ransomware deployment.

How to detect it

Investigate as a perimeter appliance compromise. Collect appliance system, event, audit, admin, access, web, and syslog records; vendor integrity checker output; configuration backups; upgrade history; authentication logs; VPN/ZTA session logs; network flow data; DNS logs; and firewall/proxy egress records. Look for requests immediately followed by appliance crashes, service restarts, child shell processes, unexpected outbound connections, or newly modified web-accessible files. Review for failed or suspicious upgrade attempts, integrity-check failures, gaps in logs, disabled logging, unexpected administrative users, configuration exports, changes to authentication settings, new certificates or keys, and unauthorized SSH or management access. Hunt for command execution artifacts such as web-service processes spawning shells, scripting interpreters, file-transfer tools, tunneling utilities, or commands writing executable content to temporary or web directories. Correlate appliance-originated authentication to internal systems, especially unusual source patterns, impossible travel, new privileged access, or access outside normal hours. Because exploitation has been active in the wild and associated with ransomware campaigns, include downstream lateral movement, credential theft, data staging, and encryption-preparation behaviors in the investigation.

• Ivanti Connect Secure 22.7R2.4
• Ivanti Connect Secure 22.7R2.3
• Ivanti Connect Secure 22.7R2.2
• Ivanti Policy Secure 22.7R1.1
• Ivanti Neurons for ZTA 22.7R2.2
• /bin/sh
• /bin/bash
• python -c
• perl -e
• curl http
• wget http
• nc -e
• ncat
• chmod +x /tmp
• /tmp/
• Integrity Checker
• file mismatch
• unexpected file
• modified file
• service restart
• segmentation fault
• core dumped

What your security team should do

• Treat any unpatched internet-facing affected appliance as a priority incident due to active exploitation, KEV status, ransomware association, and the passed CISA due date.
• Upgrade or isolate affected systems immediately; do not wait for a normal maintenance window for externally exposed appliances.
• Run vendor integrity checks before and after remediation, and preserve forensic images or log exports before rebuilding if compromise is suspected.
• If indicators of compromise are found, rebuild from trusted media, rotate all credentials and cryptographic material associated with the appliance, and invalidate active remote-access sessions.
• Search backward to at least late 2024 and continuously from the January 2025 disclosure date for suspicious appliance activity, outbound connections, new files, log gaps, and unauthorized administrative changes.
• Hunt for lateral movement originating from the appliance, including unusual authentication attempts, privileged access, remote management usage, and data staging.
• Restrict administrative access, enforce MFA for remote access, disable unused features, and monitor appliance egress to reduce post-exploitation options.
• Notify incident response, identity, network, and business continuity teams when vulnerable appliances were exposed, because compromise can affect authentication, remote access, and ransomware risk.