Ivanti · Connect Secure, Policy Secure, and ZTA Gateways
A stack-based buffer overflow in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways allows the flaw to be triggered in these products' remote-facing components. A remote attacker who needs no authentication, no user interaction, and only network access to the gateway can achieve remote code execution, though the attack is considered high complexity.
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) appeared 3 days after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
This vulnerability in Ivanti products is version-specific, requiring any reconaissance efforts to return the exact version before exploiting. If exploited, attackers may gain the ability to execute arbitrary code and harvest credentials from the compromised device. Additionally, they may perform internal reconaissance to find additional devices on the network to compromise.
CVE-specific rules are not available in this build. Search SigmaHQ ↗
These detect the technique in general, not this specific vulnerability.
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
Reports are matched by finding the exact id CVE-2025-0282 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
While there are several variations during the exploitation of CVE-2025-0282, the exploit and script generally performs the following steps:
5 passages name itOriginal (opens in a new tab) ↗
CVE-2025-0282 is a buffer overflow vulnerability caused by the strncpy function, and the malware dynamically fixes it by hooking the strncpy function and limiting the copy size to 256.
4 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.