CVE-2025-0282

Published Jan 8, 2025

Last updated 2 days ago

Insights

Analysis from the Intruder Security Team
Published Jan 9, 2025

Buffer Overflows such as this one require an advanced skillset, and time and knowledge to exploit. In addition, the exploit must be specific to the version that is targeted (as noted by Google Mandiant).

The recommendation is to fix according to your usual critical patching schedule, but prioritise over other criticals as this vulnerability has been added to the KEV list. That said, due to the complexities with this vulnerability class, we don't expect widespread exploitation.

Patching information has been released by Ivanti. However, the recommendation to use the ICT scanner by Ivanti appears to be flawed as pointed out by Google Mandiant. To help with detecting compromises, they have released YARA rules for this vulnerability.

Overview

Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
Source
3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD status
Undergoing Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
9
Impact score
6
Exploitability score
2.2
Vector string
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Known exploits

Data from CISA

Vulnerability name
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Exploit added on
Jan 8, 2025
Exploit action due
Jan 15, 2025
Required action
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

Weaknesses

3c1d8aa1-5a33-4ea4-8992-aadd6440af75
CWE-121

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

9

  1. #Vulnerability #CVE20250282 CVE-2025-0282 (CVSS 9.0): Ivanti Confirms Active Exploitation of Critical Flaw https://t.co/mil3H5LnzV

    @Komodosec

    12 Jan 2025

    11 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. gxc please do a Poc CVE-2025-0282 #Ivanti Connect Secure zero-day :/product.name="Ivanti Connect Secure"||product[.]name="Ivanti Policy Secure"||product[.]name="Ivanti Neurons for ZTA" .bin https://t.co/sr2KcnhVxT

    @byt3n33dl3

    12 Jan 2025

    53 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  3. ICYMI: Ivanti released security updates to address vulnerabilities (CVE-2025-0282, CVE-2025-0283) in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. For mitigation guidance and help reducing exposure learn more: https://t.co/0CaiNE9kEp https://t.co/BkX2Fpcy0n

    @CISAgov

    11 Jan 2025

    4291 Impressions

    16 Retweets

    39 Likes

    4 Bookmarks

    4 Replies

    1 Quote

  4. wheres the polymarket link to bet if uscourts got popped with CVE-2025-0282 ? asking for a friend. https://t.co/N7WDpeCQcW

    @lcfr_eth

    11 Jan 2025

    23 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. آسیب پذیری CVE-2025-0282 در محصولات ایوانتی مورد سوء استفاده قرار گرفت! #Cyber_security_news #اخبار_امنیت_سایبری #CVE_2025_0282 #CVE_2025_0283 #Ivanti https://t.co/hQq4TULqPD

    @vulnerbyte

    11 Jan 2025

    41 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  6. GitHub - absholi7ly/CVE-2025-0282-Ivanti-exploit: CVE-2025-0282 is a critical vulnerability found in Ivanti Connect Secure, allowing Remote Command Execution (RCE) through a buffer overflow exploit. - https://t.co/GDR3GwYRXh

    @piedpiper1616

    11 Jan 2025

    3836 Impressions

    16 Retweets

    60 Likes

    26 Bookmarks

    1 Reply

    1 Quote

  7. چند روز پیش ۲ آسیب پذیری خطرناک با کدهای شناسایی CVE-2025-0282 از نوع Buffer overflow با نمره آسیب پذیری ۹ و CVE-2025-0283 از نوع Privilege escalation با نمره آسیب پذیری ۷ برای محصولات ZTA Gateways و Connect Secure مربوط به ivanti منتشر شده بود

    @cybernetic_cy

    11 Jan 2025

    157 Impressions

    2 Retweets

    6 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Analyzing CVE-2025-0282 in Ivanti products?🔍 Skip the endless research - our https://t.co/PSyP1Jh2rM has you covered. Ask questions, get instant answers, and focus on what matters: securing your systems. @transilienceai https://t.co/nssFTFfN7N #Ivanti #CVE20250282 #Cybersecurity

    @iammuzaffar640

    11 Jan 2025

    10 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. Critical security alert! 🚨 CVE-2025-0282 reveals a stack overflow vulnerability in Ivanti devices, allowing remote code execution. Affects Connect Secure, Policy Secure, and Neurons for ZTA. #Ivanti #RemoteCodeExecution #USA #ThreatResearch link: https://t.co/Tf37CINs5O https:/

    @TweetThreatNews

    11 Jan 2025

    106 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  10. 🔵🟡🔴プログラミンニュース ~気になるニュースをピックアップ~ Ivanti Connect Secureなどにおける脆弱性(CVE-2025-0282)に関する注意喚起 https://t.co/G9Pb4a1jqN #ICT

    @programmin_net

    11 Jan 2025

    111 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  11. #Poc CVE-2025-0282 #Ivanti Connect Secure zero-day @HunterMapping :/product.name="Ivanti Connect Secure"||https://t.co/e8W7FmbzuL="Ivanti Policy Secure"||https://t.co/e8W7FmbzuL="Ivanti Neurons for ZTA" https://t.co/sAUZM91cdP https://t.co/4TX2pSArmZ

    @absholi7ly

    11 Jan 2025

    3315 Impressions

    3 Retweets

    31 Likes

    17 Bookmarks

    3 Replies

    2 Quotes

  12. Ivanti Connect Secure Zero-Day Threat: 2,048 Vulnerable Devices and Critical Exploitation Details Unveiled Discover the details of CVE-2025-0282, a critical flaw affecting Ivanti Connect Secure appliances. Find out how it allows remote code execution https://t.co/KA63ACnEcK

    @the_yellow_fall

    11 Jan 2025

    246 Impressions

    1 Retweet

    3 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. SCMagazine: Researchers with Google’s @Mandiant security team said that one or more threat actors are exploiting CVE-2025-0282 in Ivanti Connect Secure VPN for remote takeover attacks on targeted networks. #cybersecurity #infosec #ITsecurity https://t.co/d56V2nLFgO

    @MrsYisWhy

    10 Jan 2025

    110 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. China's UNC5337 exploits critical Ivanti RCE vulnerability (CVE-2025-0282) again, deploying sophisticated malware to compromise systems. Patches are out, but risk remains high. 🔒💻 #Ivanti #Malware #China #CybersecurityNews link: https://t.co/fNtaK4RbEC https://t.co/AEHBx1z5Bt

    @TweetThreatNews

    10 Jan 2025

    88 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  15. Ivanti warns that the CVE-2025-0282 zero-day vulnerability in Connect Secure is currently being exploited. Users are advised to apply the available patches to protect their systems. #CVE2025 #CyberSecurity #Ivanti https://t.co/CkSSYAgqmT

    @techday_au

    10 Jan 2025

    18 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. Two #vulnerabilities, CVE-2025-0282 & CVE-2025-0283, were discovered in @GoIvanti Connect Secure VPN appliances and related products. Ivanti has released patches and has instructed customers to follow recommendations in their Security Advisory. https://t.co/KsbV9ecJeg

    @Surefire_Cyber

    10 Jan 2025

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  17. .@Mandiant linked a Chinese nation-state actor to the recent exploitation of #Ivanti zero-day flaw tracked as CVE-2025-0282. #Cybersecurity https://t.co/STJ9m8Kh9J

    @TechTargetNews

    10 Jan 2025

    237 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. Mapa Ivanti Connect Secure CVE-2025-0282 https://t.co/raL1NaGcr0 https://t.co/nN1wPGCIFU https://t.co/U8dd4tE7eb

    @elhackernet

    10 Jan 2025

    2009 Impressions

    0 Retweets

    5 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  19. In case anyone is tracking this Ivanti 0day (CVE-2025-0282, CVE-2025-0283), I thought I'd save you some work with Sigma conversion etc. Thanks to the awesome folks at @Mandiant for their continued guidance and for being the bomb! :) https://t.co/SWxJqZjTGj #soc #blueteam… https

    @n3tl0kr

    10 Jan 2025

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. Ivanti has confirmed critical vulnerabilities in Ivanti Connect Secure (CVE-2025-0282 & CVE-2025-0283) with serious implications for enterprise security. CVE-2025-0282 is actively exploited, remote attackers can execute code and escalate privileges. Stay Vigilant! #CyberSecur

    @Shift6Security

    10 Jan 2025

    89 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. Zero-Day Exploitation for CVE-2025-0282 impacting Ivanti appliances. More details in: https://t.co/ViITs38m4d

    @GrimmAnalyst

    10 Jan 2025

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. 🚨 Advisory: Suspected Chinese Threat Actors Exploit Ivanti Connect Secure Vulnerability CVE-2025-0282 as a Zero-Day, Deploying Malware and Exfiltrating Data. Read the full advisory here: https://t.co/BOWLJioqaX #Cybersecurity #ThreatIntel #Ivanti https://t.co/PGqqvv8tda

    @deepwatch_sec

    10 Jan 2025

    28 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. Critical Vulnerability Uncovered: CVE-2025-0282 Puts Ivanti Systems at Risk https://t.co/U05v8elGl6

    @WhalersLtd

    10 Jan 2025

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  24. Ivanti Connect Secure VPN Zero-Day Exploitation (CVE-2025-0282) #CVE20250282 #CVE20250283 #CyberSecurity #Ivanti #Mandiant #UNC5221 https://t.co/DOgQqBCmCC

    @SystemTek_UK

    10 Jan 2025

    65 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. 📢Ivanti เตือนถึงช่องโหว่ CVE-2025-0282 ถูกใช้ในโจมตีแบบ Zero-Day #ThaiCERT #NCSA #CybersecurityNew 📥สามารถติดตามข่าวสารได้ที่ https://t.co/HCsLrrY1eE https://t.co/ljLv2g0hIv

    @ThaiCERTByNCSA

    10 Jan 2025

    86 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. We have started reporting unpatched Ivanti Connect Secure instances likely vulnerable to the new known to be exploited in the wild CVE-2025-0282. We see 2048 likely vulnerable instances worldwide on 2024-01-09. Top: US Dashboard overview by country: https://t.co/curshSlWem http

    @Shadowserver

    10 Jan 2025

    2456 Impressions

    11 Retweets

    26 Likes

    6 Bookmarks

    1 Reply

    0 Quotes

  27. [주의] ivanti 취약점(CVE-2025-0282, CVE-2025-0282) 패치 권고 https://t.co/kLaEpI7C3j

    @virusmyths

    10 Jan 2025

    58 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  28. 🚨 Nouvelle vulnérabilité critique CVE-2025-0282 exploitée dans des attaques zero-day ! Ivanti met en garde contre les risques de code à distance avec Connect Secure. Analystes de la sécurité, restez à l'affût ! #Cybersecurite #ZeroDay #AlerteSecurite 👉 https://t.co/7cas6udY4W

    @CyberAlertFr

    10 Jan 2025

    1 Impression

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  29. #CVE Alert CVE-2025-0282, affecting Ivanti Connect Secure, Policy Secure, and ZTA Gateways, is being exploited in the wild, leading to remote code execution. 🔗https://t.co/tnqjmWm7Xm 🔗https://t.co/BC2NBkk70j 🔗https://t.co/ADXMv8hIvy 🔗 https://t.co/VTmysPmgcl #CTIRadar

    @CTIRadar

    10 Jan 2025

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  30. ☠️ "VPN Zero-Day [CVE-2025-0282] actively exploited since Dec 4. 2024!"

    @byt3n33dl3

    10 Jan 2025

    78 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  31. ノリノリで解説するIvanti Connect Secure RCE (CVE-2025-0282)の脆弱性調査結果。面白かった / “Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282)” https://t.co/fZtQO73ziz

    @ockeghem

    10 Jan 2025

    5689 Impressions

    0 Retweets

    13 Likes

    12 Bookmarks

    0 Replies

    0 Quotes

  32. is it Friday? a few hours ago, we triggered Ivanti's [CVE-2025-0282.] you know the drill, speak soon.

    @byt3n33dl3

    10 Jan 2025

    111 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  33. Do Secure-By-Design Pledges Come With Stickers? - Ivanti Connect Secure RCE (CVE-2025-0282) - watchTowr Labs https://t.co/DwcSllFebm

    @_r_netsec

    10 Jan 2025

    787 Impressions

    1 Retweet

    4 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  34. Do Secure-By-Design pledges come with stickers? Join watchTowr Labs again, for a walkthrough of Ivanti's CVE-2025-0282 - the pre-auth RCE in their Connect Secure appliance. The timer has begun on our Detection Artefact Generator..... https://t.co/mW3dF0Vzb7

    @watchtowrcyber

    10 Jan 2025

    10443 Impressions

    35 Retweets

    108 Likes

    31 Bookmarks

    7 Replies

    3 Quotes

  35. is it Friday? a few hours ago, we triggered Ivanti's CVE-2025-0282. you know the drill, speak soon. https://t.co/tEumTh3ddU

    @watchtowrcyber

    10 Jan 2025

    17705 Impressions

    27 Retweets

    138 Likes

    30 Bookmarks

    9 Replies

    4 Quotes

  36. To continue our recognition of the majestic late 1900s era stack overflow CVE-2025-0282, along with the heaps of other vulnerabilities in @GoIvanti products we leave you an ode dedicated to your terrible coding ye old snake oil corp https://t.co/6cDdRABh4X

    @uwu_underground

    10 Jan 2025

    2873 Impressions

    4 Retweets

    25 Likes

    5 Bookmarks

    0 Replies

    3 Quotes

  37. Ivanti Connect SecureのCVE-2025-0282はMandiant曰く24/12/24頃から悪用されており25/1/8にパッチリリース https://t.co/iN0IZfGf0G 去年大騒ぎになった同じくIvanti/Pulse Connect Secure のゼロデイ CVE-2024-21887、CVE-2023-46805も23/12から攻撃があり翌年1/10以降に対策リリース… https://t.co/qp3L0ryDAT

    @nekono_naha

    9 Jan 2025

    1106 Impressions

    4 Retweets

    11 Likes

    2 Bookmarks

    0 Replies

    0 Quotes

  38. Chinese spies are exploiting a new Ivanti VPN vulnerability (CVE-2025-0282), raising alarms for U.S. agencies. New malware families DRYHOOK & PHASEJAM identified. #Ivanti #CISA #China 🛡️🖥️ #CybersecurityNews link: https://t.co/SEKOsWaRIK https://t.co/jCMLoZd3OF

    @TweetThreatNews

    9 Jan 2025

    160 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  39. #Ivanti Connect Secure zero-day exploited since mid-December (CVE-2025-0282) #Security https://t.co/H7mOc7XSP2

    @thinksnews

    9 Jan 2025

    130 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  40. Ivanti Connect Secureなどにおける脆弱性(CVE-2025-0282)に関する注意喚起 #JPCERTCC (Jan 9) https://t.co/ZOQ44n95C2

    @foxbook

    9 Jan 2025

    336 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  41. 🚨 Patch #Ivanti Connect Secure for critical remote code execution (CVE-2025-0282) and escalation (CVE-2025-0283). Upgrade to latest versions and use Integrity Checker Tool. Learn more: https://t.co/RybtiSOfc4 https://t.co/pwblzxH2Zg

    @wiz_io

    9 Jan 2025

    166 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  42. CVE-2025-0283 is also critical but less detailed at this stage. Active exploitation of CVE-2025-0282 has been linked to espionage campaigns by Chinese nexus actors like UNC5337. #hoploninfosec #cve2025 #CyberSecurity #vulnerable #infosecurity https://t.co/axtUj5KmIK

    @HoplonInfosec

    9 Jan 2025

    494 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  43. 🚨 Zero-Day Alert: Critical Ivanti Connect Secure Flaw Exploited in Active Attacks! 🚨 WIRE TOR - The Ethical Hacking Services Ivanti has issued an urgent warning about a new zero-day vulnerability (CVE-2025-0282) affecting its Connect Secure appliances. #hacker https://t.co/aAR

    @WireTor

    9 Jan 2025

    274 Impressions

    1 Retweet

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  44. UNC5337 is exploiting CVE-2025-0282 RCE in the wild. Fire and doom everywhere. #zeroday #cybersecurity #ivanti https://t.co/60jH3yThyX

    @gellin1337

    9 Jan 2025

    817 Impressions

    0 Retweets

    4 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  45. RCE in Ivanti exploited in the wild. Successful exploitation of CVE-2025-0282 could lead to unauthenticated remote code execution. CVE-2025-0283 could allow a local authenticated attacker to escalate privileges. https://t.co/58rmrIlkc3

    @router_bugs

    9 Jan 2025

    277 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  46. Ivanti Connect Secureの脆弱性CVE-2025-0282、AC:Hなんだけど、妙に界隈がざわついてる。2025/1/8にKEVに追加されていて、EPSSで48時間以内に公開されたCVEの中でもトップレベルでアカン。そして、これ悪用したかなり悪質な攻撃が、すでに発生している。 https://t.co/LHMvcLXr6N https://t.co/LdP691vi0s

    @wakatono

    9 Jan 2025

    122 Impressions

    0 Retweets

    0 Likes

    1 Bookmark

    1 Reply

    1 Quote

  47. 🚨 #IvantiConnectSecure VPN Zero-Day (CVE-2025-0282) actively exploited since Dec. 2024! Learn about our initial investigations: https://t.co/Dp2LrMUWtk #Cybersecurity #ZeroDay #ThreatIntel https://t.co/36rkh9zjnJ

    @Mandiant

    9 Jan 2025

    11088 Impressions

    45 Retweets

    101 Likes

    23 Bookmarks

    2 Replies

    4 Quotes

  48. CVE-2025-0282 vai vai vai vai

    @detrew1337

    9 Jan 2025

    297 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  49. CVE-2025-0282 ?

    @dfelaz

    9 Jan 2025

    271 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  50. 🚨Upozorňujeme na dvě aktivně zneužívané a závažné zranitelnost v Ivanti Connect Secure, Policy Secure a ZTA Gateways. Zneužití zranitelnosti CVE-2025-0282 může vést k neautentizovanému vzdálenému spuštění škodlivého kódu, a zneužití zranitelnosti CVE-2025-0283 umožní lokálnímu…

    @GOVCERT_CZ

    9 Jan 2025

    532 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes