CVE-2025-0282

Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

CVSS breakdown

Affected products

• Ivanti / Connect Secure22.7R2 – 22.7R2.4
• Ivanti / Connect Secure22.7R2.5 – 22.7R2.5
• Ivanti / Connect Secure22.7 – 22.7
• Ivanti / Connect Secure22.7 – 22.7
• Ivanti / Connect Secure22.7 – 22.7
• Ivanti / Connect Secure22.7 – 22.7
• Ivanti / Connect Secure22.7 – 22.7
• Ivanti / neurons_for_zero-trust_access22.7 – 22.7
• Ivanti / neurons_for_zero-trust_access22.7 – 22.7
• Ivanti / neurons_for_zero-trust_access22.7 – 22.7
• Ivanti / Neurons for ZTA gateways22.7R2 – 22.7R2.3
• Ivanti / Neurons for ZTA gateways22.7R2.5 – 22.7R2.5
• Ivanti / Policy Secure22.7R1 – 22.7R1.2
• Ivanti / Policy Secure22.7 – 22.7
• Ivanti / Policy Secure22.7 – 22.7
• Ivanti / Policy Secure22.7 – 22.7

Exploits & proofs of concept

• exploit-dbIvanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE)by Abdualhadi khalifa
• nucleiIvanti Connect Secure - Stack-based Buffer Overflowby ritikchaddha

References

• MISChttps://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283