CVE-2025-0283

Published Jan 8, 2025

Last updated 4 days ago

Overview

Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.
Source
3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD status
Analyzed

Risk scores

CVSS 3.1

Type
Primary
Base score
7
Impact score
5.9
Exploitability score
1
Vector string
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity
HIGH

Weaknesses

3c1d8aa1-5a33-4ea4-8992-aadd6440af75
CWE-121
nvd@nist.gov
CWE-787

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

3

  1. 🚨 CVE-2025-0283 affects Ivanti secure access solutions, enabling attackers to escalate privileges. Read the full #CybersecurityThreatAdvisory now to protect your systems: https://t.co/5KSb8ICrAK

    @SmarterMSP

    18 Jan 2025

    17 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Threat Brief: CVE-2025-0282 and CVE-2025-0283 (Updated Jan. 17) https://t.co/m9cdWAII8n

    @itsecuritynewsl

    17 Jan 2025

    32 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  3. Ivanti’s Security Slip-Up: CVE-2025-0282 and CVE-2025-0283 Vulnerabilities Leave the Door Wide Open! Hot Take: Ivanti's tech is as secure as a chocolate teapot! Two new vulnerabilities have popped up in their Connect Secure, Policy Secure, and ZTA gateway products, making them…

    @TheNimbleNerd

    17 Jan 2025

    98 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  4. CVE-2025-0282 and CVE-2025-0283 affect multiple Ivanti products. Unit 42 telemetry reveals threat activity potentially exploiting the CVE-2025-0282 0-day in a public-facing Ivanti Connect Secure (ICS) VPN appliance. This threat brief details our findings. https://t.co/Ilx092CkFQ

    @Unit42_Intel

    17 Jan 2025

    8045 Impressions

    21 Retweets

    74 Likes

    13 Bookmarks

    0 Replies

    3 Quotes

  5. I've been analyzing newly disclosed vulnerabilities in popular systems, including Mitel MiCollab (CVE-2024-41713, CVE-2024-35286), Zyxel Firewalls (CVE-2024-11667), and Microsoft Windows (CVE-2024-35250, CVE-2024-49138). Ivanti is also affected (CVE-2025-0282, CVE-2025-0283).

    @agentwhitehat

    15 Jan 2025

    232 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  6. 🚨 Ivanti Connect Secure Vulnerabilities Discovered 🚨 CVE-2025-0282 & CVE-2025-0283 expose critical business functions, posing major risks. 🔍 Learn the details, impacts, & mitigation steps in our blog: https://t.co/SbGgeASIhj #Cybersecurity #EASM #IncidentResponse https

    @CyCognito

    14 Jan 2025

    287 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  7. 🚨 Critical vulnerabilities in Ivanti products (CVE-2025-0282, CVE-2025-0283) disclosed! Active exploitation detected—learn how to protect your systems now. Details & mitigation steps: https://t.co/MUGQbilrGV #CyberSecurity #Ivanti https://t.co/6sLtIZvZgf

    @BaseFortify

    14 Jan 2025

    90 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Threat Alert: Ivanti Rolls Out Patches to Mitigate Exploits in Connect Secure, Policy Secure, CVE-2025-0283 CVE-2025-0282 Severity: ⚠️ Critical Maturity: 💥 Mainstream Learn more: https://t.co/vYn3sbeIIl #CyberSecurity #ThreatIntel #InfoSec

    @fletch_ai

    14 Jan 2025

    21 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. چند روز پیش ۲ آسیب پذیری خطرناک با کدهای شناسایی CVE-2025-0282 از نوع Buffer overflow با نمره آسیب پذیری ۹ و CVE-2025-0283 از نوع Privilege escalation با نمره آسیب پذیری ۷ برای محصولات ZTA Gateways و Connect Secure مربوط به ivanti منتشر شده بود. https://t.co/Poz3aKY03t https://t.

    @AmirHossein_sec

    12 Jan 2025

    84 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. ICYMI: Ivanti released security updates to address vulnerabilities (CVE-2025-0282, CVE-2025-0283) in Ivanti Connect Secure, Policy Secure, and ZTA Gateways. For mitigation guidance and help reducing exposure learn more: https://t.co/0CaiNE9kEp https://t.co/BkX2Fpcy0n

    @CISAgov

    11 Jan 2025

    5124 Impressions

    24 Retweets

    55 Likes

    3 Bookmarks

    5 Replies

    1 Quote

  11. چند روز پیش ۲ آسیب پذیری خطرناک با کدهای شناسایی CVE-2025-0282 از نوع Buffer overflow با نمره آسیب پذیری ۹ و CVE-2025-0283 از نوع Privilege escalation با نمره آسیب پذیری ۷ برای محصولات ZTA Gateways و Connect Secure مربوط به ivanti منتشر شده بود

    @cybernetic_cy

    11 Jan 2025

    163 Impressions

    2 Retweets

    6 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. Two #vulnerabilities, CVE-2025-0282 & CVE-2025-0283, were discovered in @GoIvanti Connect Secure VPN appliances and related products. Ivanti has released patches and has instructed customers to follow recommendations in their Security Advisory. https://t.co/KsbV9ecJeg

    @Surefire_Cyber

    10 Jan 2025

    57 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  13. In case anyone is tracking this Ivanti 0day (CVE-2025-0282, CVE-2025-0283), I thought I'd save you some work with Sigma conversion etc. Thanks to the awesome folks at @Mandiant for their continued guidance and for being the bomb! :) https://t.co/SWxJqZjTGj #soc #blueteam… https

    @n3tl0kr

    10 Jan 2025

    9 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. Ivanti has confirmed critical vulnerabilities in Ivanti Connect Secure (CVE-2025-0282 & CVE-2025-0283) with serious implications for enterprise security. CVE-2025-0282 is actively exploited, remote attackers can execute code and escalate privileges. Stay Vigilant! #CyberSecur

    @Shift6Security

    10 Jan 2025

    89 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  15. Urgent: Ivanti VPNs under attack! Hackers exploit CVE-2025-0283 for complete control. Patch immediately! #IvantiVPN #Cybersecurity #ZeroDayExploit https://t.co/uE9647c87R

    @TLDRStories

    9 Jan 2025

    59 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  16. CVE-2025-0283 01/08/2025 11:15:09 PM BaseSeverity: HIGH A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Pol... https://t.co/mhmm7mHDrP

    @CVETracker

    9 Jan 2025

    53 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  17. 🚨 Patch #Ivanti Connect Secure for critical remote code execution (CVE-2025-0282) and escalation (CVE-2025-0283). Upgrade to latest versions and use Integrity Checker Tool. Learn more: https://t.co/RybtiSOfc4 https://t.co/pwblzxH2Zg

    @wiz_io

    9 Jan 2025

    166 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. CVE-2025-0283 is also critical but less detailed at this stage. Active exploitation of CVE-2025-0282 has been linked to espionage campaigns by Chinese nexus actors like UNC5337. #hoploninfosec #cve2025 #CyberSecurity #vulnerable #infosecurity https://t.co/axtUj5KmIK

    @HoplonInfosec

    9 Jan 2025

    494 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  19. RCE in Ivanti exploited in the wild. Successful exploitation of CVE-2025-0282 could lead to unauthenticated remote code execution. CVE-2025-0283 could allow a local authenticated attacker to escalate privileges. https://t.co/58rmrIlkc3

    @router_bugs

    9 Jan 2025

    277 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. 🚨Upozorňujeme na dvě aktivně zneužívané a závažné zranitelnost v Ivanti Connect Secure, Policy Secure a ZTA Gateways. Zneužití zranitelnosti CVE-2025-0282 může vést k neautentizovanému vzdálenému spuštění škodlivého kódu, a zneužití zranitelnosti CVE-2025-0283 umožní lokálnímu…

    @GOVCERT_CZ

    9 Jan 2025

    532 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. 🚨 Cybersecurity Alert 🚨 Ivanti Connect Secure hit by CVE-2025-0282 & CVE-2025-0283 vulnerabilities. CVE-2025-0282 actively exploited! Patch up your systems ASAP to stay secure. #InfoSec #ZeroDay https://t.co/LUzPOPkgY5

    @ThreatVector24

    9 Jan 2025

    133 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. #CCNALERTA El CCN-CERT alerta sobre una campaña activa de explotación de dispositivos @GoIvanti y recomienda aplicar los parches (CVE-2025-0282, CVE-2025-0283) y medidas compartidos por el fabricante. 📝https://t.co/CzuXCp3zQX https://t.co/jzrWi73V8K

    @CCNCERT

    9 Jan 2025

    633 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. Mandiant & Ivanti look into an active campaign exploiting two vulnerabilities, CVE-2025-0282 & CVE-2025-0283, impacting Ivanti Connect Secure VPN appliances. They observed the known SPAWN ecosystem of malware as well as new families DRYHOOK & PHASEJAM. https://t.co/Co

    @virusbtn

    9 Jan 2025

    2692 Impressions

    8 Retweets

    21 Likes

    7 Bookmarks

    1 Reply

    0 Quotes

  24. CVE-2025-0282,CVE-2025-0283 alert 🚨 Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability The vulnerability is actively exploited in the wild and has been integrated into Patrowl. Our customers assets are protected. 🦉 #Ivanti #Cybersec

    @Patrowl_io

    9 Jan 2025

    239 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  25. 🚨 Critical Vulnerabilities exist in Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283). Please see the @ncsc_gov_ie advisory here for more info: https://t.co/E8FLLrZciQ

    @ncsc_gov_ie

    9 Jan 2025

    610 Impressions

    2 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. Korzystacie z Ivanti Connect Secure (czyli dawnego Pulse Secure)? Jeżeli tak, to koniecznie zwróćcie uwagę te dwie podatności: - CVE-2025-0282 - pozwala zdalnie i bez autoryzacji wykonywać kod na urządzeniu (czyli np. podrzucić malware). - CVE-2025-0283 - umożliwia na eskalację

    @komputerow

    9 Jan 2025

    653 Impressions

    1 Retweet

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  27. Ivanti Connect Secure、Policy Secure、ZTA Gateway (CVE-2025-0282、CVE-2025-0283)の脆弱性に対処する更新プログラムをリリース スタックベースのバッファ オーバーフローにより、認証されていないリモートの攻撃者がリモート コードを実行できる可能性 CVE-2025-0282 CVSS9.0 Critical など https://t.co/0mv6hewfNO

    @t_nihonmatsu

    9 Jan 2025

    1017 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    1 Quote

  28. Ivanti VPN Zero-Day Vulnerability Actively Exploited in the Wild Source: https://t.co/FXB4JlEX1n CVE-2025-0282 CVSS 9.0 (Critical) Exploited in-the-wild CVE-2025-0283 CVSS 7.0 (High) A stack-based buffer overflow #cybersecurity #vulnerability #ivanti

    @gbhackers_news

    9 Jan 2025

    60 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  29. Ivanti has warned that hackers are exploiting a new vulnerability, CVE-2025-0282, with some customers already affected; they released an advisory and blog detailing this and another bug, CVE-2025-0283. #CyberSecurity #Vulnerability https://t.co/jgUmWlStML

    @Cyber_O51NT

    9 Jan 2025

    698 Impressions

    2 Retweets

    11 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  30. #Ivanti released security updates to address CVE-2025-0282—being actively exploited—and CVE-2025-0283, affecting Connect Secure, Policy Secure, and ZTA Gateways. See our Alert for mitigation guidance to help reduce your exposure: https://t.co/7aNpk5oh73 https://t.co/u42fvgL13H

    @CISACyber

    8 Jan 2025

    40595 Impressions

    111 Retweets

    193 Likes

    33 Bookmarks

    4 Replies

    14 Quotes

  31. Ivanti customers, connect secure/policy secure and ZTA gateway folks. Shits fucked. New 0days for unauthed code execution. CVE-2025-0282 and CVE-2025-0283 https://t.co/Q0TrKTQPdW

    @ha3ks

    8 Jan 2025

    478 Impressions

    0 Retweets

    4 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  32. CVE-2025-0283 A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before… https://t.co/hKskJv4oUM

    @CVEnew

    8 Jan 2025

    418 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  33. Ivanti warns of critical vulnerabilities CVE-2025-0282 & CVE-2025-0283 in their products, enabling remote code execution & privilege escalation attacks. Immediate upgrades are advised. 🔒🔥 #Ivanti #RemoteExecution #USA #CybersecurityNews link: https://t.co/sxZc4hshli ht

    @TweetThreatNews

    8 Jan 2025

    13 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  34. 🚨🚨🚨Ivanti, a leading provider of enterprise security solutions, has announced the discovery of two critical zero-day vulnerabilities in its Connect Secure (ICS) product. https://t.co/3Hl3zWBZcg The vulnerabilities, identified as CVE-2025-0282 and CVE-2025-0283, are currently…

    @DarkWebInformer

    8 Jan 2025

    6428 Impressions

    15 Retweets

    51 Likes

    7 Bookmarks

    1 Reply

    1 Quote

  35. Ivanti Warns of New Zero-Day Attacks Hitting Connect Secure Product - (CVE-2025-0282 and CVE-2025-0283) https://t.co/jO6Ur7hboe

    @SecurityWeek

    8 Jan 2025

    3359 Impressions

    12 Retweets

    21 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  36. 🚨 Ivanti Security Advisory: Critical Vulnerabilities 🚨 Two high-severity flaws impact Ivanti Connect Secure, Policy Secure, & ZTA Gateways: CVE-2025-0282: Remote Code Execution (CVSS 9.0). Exploited in the wild. CVE-2025-0283: Local Privilege Escalation (CVSS 7.0). 🛠️ P

    @arunpratap786

    8 Jan 2025

    130 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  37. 🚨 Ivanti Security Advisory: Critical Vulnerabilities 🚨 Two high-severity flaws impact Ivanti Connect Secure, Policy Secure, & ZTA Gateways: CVE-2025-0282: Remote Code Execution (CVSS 9.0). Exploited in the wild. CVE-2025-0283: Local Privilege Escalation (CVSS 7.0). 🛠️ P

    @arunpratap786

    8 Jan 2025

    5 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  38. 📢 Security Advisory Ivanti Connect Secure, Policy Secure & ZTA Gateways (CVE-2025-0282, CVE-2025-0283) CVE-2025-0282 is already being exploited. https://t.co/Rc6AU0UA4D

    @fabian_bader

    8 Jan 2025

    64 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  39. CVE-2025-0282 (CVSS 9.0): #Ivanti Confirms Active Exploitation of Critical Flaw Stay informed about the security advisory addressing CVE-2025-0282 and CVE-2025-0283 vulnerabilities in Ivanti's Connect Secure, Policy Secure, and Neurons for ZTA Gateways https://t.co/U4oQOLgf9n

    @the_yellow_fall

    8 Jan 2025

    664 Impressions

    3 Retweets

    8 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  40. 🚨 PATCH TIME 📢 Ivanti UNAUTHENTICATED Remote Code Execution ⚠️ CVE-2025-0282 / CVE-2025-0283 #ivanti #cybersecurity #cve https://t.co/18XABaUp00

    @sheridancompute

    8 Jan 2025

    77 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    2 Replies

    0 Quotes

Configurations