Patchfirst
Patchfirst
CVE-2025-0283 High · 7.0 EPSS 17.5%

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version…

Ivanti · Connect Secure

Summary

A stack-based buffer overflow in Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways allows a local authenticated attacker to escalate their privileges. It affects Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3.

Official description · CVE.org

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.

Breakdown
78.5 / 100
Exploited
Yes, in VulnCheck KEV
Reports
2
Tactics
0/15

First seen exploited the day it was disclosed.

  1. DisclosedFirst seen exploitedVulnCheck KEV evidenceday 0

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

What security researchers reported

Named in 2 threat reports
2 reportsGoogle Mandiantblogs.jpcert.or.jp

Reports are matched by finding the exact id CVE-2025-0283 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.

Also mentioned in 45 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

1 link, grouped by NVD tag

Other 1

forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
↑ ↓ chooseEnter openEsc close