{"id":"CVE-2025-0282","published":"2025-01-08T23:15:09Z","modified":"2026-10-01T19:17:15Z","title":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","vendor":"Ivanti","product":"Connect Secure, Policy Secure, and ZTA Gateways","tier":"core","eol":null,"description":{"text":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.","provenance":"source","from":"NVD"},"summary":{"text":"A stack-based buffer overflow in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways allows the flaw to be triggered in these products' remote-facing components. A remote attacker who needs no authentication, no user interaction, and only network access to the gateway can achieve remote code execution, though the attack is considered high complexity.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T06:54:54Z"},"cvss":{"score":9.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99981,"percentile":0.99981,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2025-01-08","dueDate":"2025-01-15","ransomware":true,"requiredAction":"Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.","notes":"CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282 Additional References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0282","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-01-08","exploitedFirstSeen":"2025-01-08","ransomware":true,"evidence":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08"},{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","date":"2025-01-08"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-01-08"},{"url":"https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerabilities","date":"2025-01-08"},{"url":"https://www.rapid7.com/blog/post/2025/01/08/etr-cve-2025-0282-ivanti-connect-secure-zero-day-exploited-in-the-wild/","date":"2025-01-08"},{"url":"https://www.wiz.io/blog/cve-2025-0282-and-cve-2025-0283-critical-ivanti-0days-exploited-in-the-wild","date":"2025-01-09"},{"url":"https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2025-0283/","date":"2025-01-17"},{"url":"https://www.shadowserver.org/what-we-do/network-reporting/compromised-website-report/","date":"2025-02-05"},{"url":"https://blogs.jpcert.or.jp/ja/2025/02/spawnchimera.html","date":"2025-02-12"},{"url":"https://www.jpcert.or.jp/at/2025/at250001.html","date":"2025-02-13"}],"evidenceTotal":60,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 30, 2026","url":"https://otx.alienvault.com/pulse/6ae35d889ea92b4ce19c2680","created":"2026-10-29"},{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","tags":["Vendor Advisory"]},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","tags":["Exploit","Technical Description"]},{"url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://github.com/sfewer-r7/CVE-2025-0282","tags":["Exploit"]},{"url":"https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","tags":["Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0282","tags":["US Government Resource"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0282","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability in Ivanti products is version-specific, requiring any reconaissance efforts to return the exact version before exploiting. If exploited, attackers may gain the ability to execute arbitrary code and harvest credentials from the compromised device. Additionally, they may perform internal reconaissance to find additional devices on the network to compromise.","confidence":"high"},{"id":"T1595","name":"Active Scanning","tactics":["reconnaissance"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"exploitation_technique","evidence":[],"comment":"This vulnerability in Ivanti products is version-specific, requiring any reconaissance efforts to return the exact version before exploiting. If exploited, attackers may gain the ability to execute arbitrary code and harvest credentials from the compromised device. Additionally, they may perform internal reconaissance to find additional devices on the network to compromise.","confidence":"high"},{"id":"T1003","name":"OS Credential Dumping","tactics":["credential-access"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability in Ivanti products is version-specific, requiring any reconaissance efforts to return the exact version before exploiting. If exploited, attackers may gain the ability to execute arbitrary code and harvest credentials from the compromised device. Additionally, they may perform internal reconaissance to find additional devices on the network to compromise.","confidence":"high"},{"id":"T1055","name":"Process Injection","tactics":["privilege-escalation","stealth"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"primary_impact","evidence":[],"comment":"This vulnerability in Ivanti products is version-specific, requiring any reconaissance efforts to return the exact version before exploiting. If exploited, attackers may gain the ability to execute arbitrary code and harvest credentials from the compromised device. Additionally, they may perform internal reconaissance to find additional devices on the network to compromise.","confidence":"high"},{"id":"T1018","name":"Remote System Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability in Ivanti products is version-specific, requiring any reconaissance efforts to return the exact version before exploiting. If exploited, attackers may gain the ability to execute arbitrary code and harvest credentials from the compromised device. Additionally, they may perform internal reconaissance to find additional devices on the network to compromise.","confidence":"high"},{"id":"T1046","name":"Network Service Discovery","tactics":["discovery"],"provenance":"source","basis":"ctid-kev","bases":["ctid-kev"],"basisDetail":"CTID Mappings Explorer KEV 07/28/2025 (ATT&CK 16.1); capability: Buffer Overflow","mappingType":"secondary_impact","evidence":[],"comment":"This vulnerability in Ivanti products is version-specific, requiring any reconaissance efforts to return the exact version before exploiting. If exploited, attackers may gain the ability to execute arbitrary code and harvest credentials from the compromised device. Additionally, they may perform internal reconaissance to find additional devices on the network to compromise.","confidence":"high"}],"reports":[{"id":"SRC-69c48a8dfa48e4fbb916","title":"Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":null,"mentions":[{"quote":"8, 2025, Ivanti disclosed two vulnerabilities, CVE-2025-0282 and CVE-2025-0283, impacting Ivanti Connect Secure (“ICS”) VPN appliances.","start":529,"end":664},{"quote":"Mandiant has identified zero-day exploitation of CVE-2025-0282 in the wild beginning mid-December 2024.","start":665,"end":768},{"quote":"CVE-2025-0282 is an unauthenticated stack-based buffer overflow.","start":769,"end":833},{"quote":"While CVE-2025-0282 affects multiple patch levels of ICS release 22.7R2, successful exploitation is version specific.","start":2495,"end":2612},{"quote":"While there are several variations during the exploitation of CVE-2025-0282, the exploit and script generally performs the following steps:","start":3250,"end":3389}]},{"id":"SRC-63202b1ec32c331e16e8","title":"SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability","publisher":"blogs.jpcert.or.jp","url":"https://blogs.jpcert.or.jp/en/2025/02/spawnchimera.html","date":null,"mentions":[{"quote":"In January 2025, Ivanti published an advisory[1] regarding the vulnerability CVE-2025-0282 in Ivanti Connect Secure.","start":121,"end":237},{"quote":"Function to fix vulnerability CVE-2025-0282","start":1323,"end":1366},{"quote":"SPAWNCHIMERA has a new function to fix the CVE-2025-0282 vulnerability.","start":2021,"end":2092},{"quote":"CVE-2025-0282 is a buffer overflow vulnerability[5] caused by the strncpy function, and the malware dynamically fixes it by hooking the strncpy function and limiting the copy size to 256.","start":2093,"end":2280},{"quote":"Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283)","start":4723,"end":4823}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-1580","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1580","exploited":true,"exploitedSince":"2025-01-08","provenance":"source"},"exploits":[{"id":52213,"url":"https://www.exploit-db.com/exploits/52213","title":"Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE)","type":"remote","platform":"multiple","date":"2025-04-15","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2025-04-15"},"pocGithub":{"count":10,"skipped":0,"earliest":"2025-01-11","earliestUrl":"https://github.com/absholi7ly/CVE-2025-0282-Ivanti-exploit","repos":[{"name":"absholi7ly/CVE-2025-0282-Ivanti-exploit","url":"https://github.com/absholi7ly/CVE-2025-0282-Ivanti-exploit","stars":53,"created":"2025-01-11"},{"name":"sfewer-r7/CVE-2025-0282","url":"https://github.com/sfewer-r7/CVE-2025-0282","stars":50,"created":"2025-01-16"},{"name":"watchtowrlabs/CVE-2025-0282","url":"https://github.com/watchtowrlabs/CVE-2025-0282","stars":31,"created":"2025-01-15"},{"name":"Hexastrike/Ivanti-Connect-Secure-Logs-Parser","url":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser","stars":6,"created":"2025-01-19"},{"name":"AnonStorks/CVE-2025-0282-Full-version","url":"https://github.com/AnonStorks/CVE-2025-0282-Full-version","stars":4,"created":"2025-01-12"}]},"nuclei":[{"id":"CVE-2025-0282","name":"Ivanti Connect Secure - Stack-based Buffer Overflow","severity":"critical","path":"http/cves/2025/CVE-2025-0282.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0282.yaml"}],"first":{"date":"2025-01-11","source":"PoC-in-GitHub","url":"https://github.com/absholi7ly/CVE-2025-0282-Ivanti-exploit"},"provenance":"source"},"exploitRefs":["https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","https://github.com/sfewer-r7/CVE-2025-0282","https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/"],"flow":[{"stage":"exploitation","techniques":["T1595","T1190"],"provenance":"source"},{"stage":"primary","techniques":["T1055","T1003"],"provenance":"source"},{"stage":"secondary","techniques":["T1018","T1046"],"provenance":"source"}],"timeline":[{"date":"2025-01-08","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","provenance":"source"},{"date":"2025-01-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","provenance":"source"},{"date":"2025-01-08","kind":"kev","label":"Added to CISA KEV (known ransomware use)","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-01-08","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1580","provenance":"source"},{"date":"2025-01-11","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Exploit-DB 2025-04-15","url":"https://github.com/absholi7ly/CVE-2025-0282-Ivanti-exploit","provenance":"source"}],"speed":{"daysToPublicExploit":3,"firstExploitFrom":"PoC-in-GitHub","daysToKev":0},"priority":{"score":85.4,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 660 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":20.0,"detail":"percentile 0.9998"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 10 PoC-in-GitHub repos; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":6.3,"detail":"base score 9.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}