{"id":"CVE-2025-0283","published":"2025-01-08T22:15:59Z","modified":"2026-02-26T19:09:31Z","title":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version…","vendor":"Ivanti","product":"Connect Secure","tier":"core","eol":null,"affectedVersions":[{"vendor":"Ivanti","product":"Connect Secure","versions":["all versions"]},{"vendor":"Ivanti","product":"Policy Secure","versions":["22.7R1.2"]},{"vendor":"Ivanti","product":"Neurons for ZTA gateways","versions":["all versions"]}],"description":{"text":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.","provenance":"source","from":"CVE.org"},"summary":{"text":"A stack-based buffer overflow in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways allows a local authenticated attacker to escalate their privileges. It affects Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3.","provenance":"ai","model":"deepseek-v4-flash","generatedAt":"2026-10-23T03:20:06Z"},"cvss":{"score":7,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.17456,"percentile":0.9712,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-01-08","exploitedFirstSeen":"2025-01-08","ransomware":true,"evidence":[{"url":"https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerabilities","date":"2025-01-08"},{"url":"https://www.wiz.io/blog/cve-2025-0282-and-cve-2025-0283-critical-ivanti-0days-exploited-in-the-wild","date":"2025-01-09"},{"url":"https://darktrace.com/blog/darktraces-early-detection-of-the-latest-ivanti-exploits","date":"2025-03-11"},{"url":"https://www.kelacyber.com/resources/research/2025_midyear_threat_report/","date":"2025-08-08"},{"url":"https://foresiet.com/blog/kimsuky-apt-data-leak/","date":"2025-08-22"},{"url":"https://falconfeeds.io/blogs/kimsuky-threat-actor-operations-infrastructure-capabilities","date":"2025-09-01"},{"url":"https://b9866c47-b467-4bc0-b154-6afa06da0ab5.usrfiles.com/ugd/b9866c_2578eb8c8ffe4257b30efef3ad0f953e.pdf","date":"2026-02-12"},{"url":"https://5943619.hs-sites.com/hubfs/312-Year-in-Review/2026/Dragos-2026-OT-Cybersecurity-Report-A-Year-in-Review.pdf","date":"2026-02-17"},{"url":"https://wwv.vulncheck.com/2026-vulncheck-exploit-intelligence-report","date":"2026-02-25"},{"url":"https://cdn.prod.website-files.com/626ff19cdd07d1258d49238d/699db1ba8d377a68f7d697b7_Threat%20Report%202026%20v4.pdf","date":"2026-02-26"}],"evidenceTotal":14,"provenance":"source"},"exploited":true,"otx":{"pulseCount":45,"pulses":[{"name":"Ernstige kwetsbaarheden in Ivanti Connect Secure en Policy Secure [Nationaal Cyber Security Centrum - Nieuwsberichten]","url":"https://otx.alienvault.com/pulse/6a6d1a51dbc532c95392ce63","created":"2026-07-31"},{"name":"Trust Bypass and Cryptographic Integrity: Have we lost a safe baseline forever? - VirusTotal report                    for software.exe","url":"https://otx.alienvault.com/pulse/6a34f2b1f362424f0edb5f66","created":"2026-06-19"},{"name":"Trust Bypass and Cryptographic Integrity: Have we lost a safe baseline forever? - VirusTotal report                    for software.exe","url":"https://otx.alienvault.com/pulse/6a34f2b06dbb1b636b47f0e3","created":"2026-06-19"},{"name":"Trust Bypass and Cryptographic Integrity: Have we lost a safe baseline forever? - VirusTotal report                    for software.exe","url":"https://otx.alienvault.com/pulse/6a34f2ae91ec0796ed29326e","created":"2026-06-19"},{"name":"Trust Bypass and Cryptographic Integrity: Have we lost a safe baseline forever? - VirusTotal report                    for software.exe","url":"https://otx.alienvault.com/pulse/6a34f2ad2a355bbbb43b5451","created":"2026-06-19"},{"name":"APT29","url":"https://otx.alienvault.com/pulse/69f46a108000bd36fe90d5be","created":"2026-05-01"},{"name":"TTB-Chained (Tehran-Transversal Belasco Chain)","url":"https://otx.alienvault.com/pulse/69a82c54067ca1d502b1eb6c","created":"2026-03-04"},{"name":"TTB-Chained (Tehran-Transversal Belasco Chain)","url":"https://otx.alienvault.com/pulse/69a82c53aae1e6d8b8213ff9","created":"2026-03-04"},{"name":"The Belasco Chain","url":"https://otx.alienvault.com/pulse/69a02837827feb0b78fa3ad2","created":"2026-02-26"},{"name":"Project AK47: Uncovering a Link to the SharePoint Vulnerability Attacks","url":"https://otx.alienvault.com/pulse/689acfc265f4f2c8cfea1553","created":"2025-08-12"}],"provenance":"machine"},"cwes":[{"id":"CWE-121","name":"Stack-based Buffer Overflow"}],"references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","tags":[]}],"techniques":[],"reports":[{"id":"SRC-69c48a8dfa48e4fbb916","title":"Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation","publisher":"cloud.google.com","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":null,"mentions":[{"quote":"8, 2025, Ivanti disclosed two vulnerabilities, CVE-2025-0282 and CVE-2025-0283, impacting Ivanti Connect Secure (“ICS”) VPN appliances.","start":529,"end":664}]},{"id":"SRC-63202b1ec32c331e16e8","title":"SPAWNCHIMERA Malware: The Chimera Spawning from Ivanti Connect Secure Vulnerability","publisher":"blogs.jpcert.or.jp","url":"https://blogs.jpcert.or.jp/en/2025/02/spawnchimera.html","date":null,"mentions":[{"quote":"Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283)","start":4723,"end":4823},{"quote":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283?language=en_US","start":4825,"end":4970}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-1581","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-1581","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":null,"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-01-08","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-0283","provenance":"source"},{"date":"2025-01-08","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerabilities","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":78.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 660 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.42,"detail":"percentile 0.9712"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":0.0,"detail":"none found"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"45 pulses"},{"name":"CVSS severity","points":4.9,"detail":"base score 7"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}