Vulnerability Details CVE-2025-0282
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.929
EPSS Ranking 99.8%
CVSS Severity
CVSS v3 Score 9.0
Proposed Action
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.
Ransomware Campaign
Unknown
References
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
- https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
- https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282
- https://github.com/sfewer-r7/CVE-2025-0282
- https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0282
Products affected by CVE-2025-0282
-
cpe:2.3:a:ivanti:connect_secure:22.7
-
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7
-
cpe:2.3:a:ivanti:policy_secure:22.7