CVE-2025-22457

Published Apr 3, 2025

Last updated 13 days ago

Exploit known CVSS critical 9.0

Ivanti

Connect Secure

Policy Secure

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-22457 is a stack-based buffer overflow vulnerability affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti ZTA Gateways. It allows a remote, unauthenticated attacker to execute arbitrary code on the target device. The vulnerability is triggered by network access to the impacted appliances. Exploitation of CVE-2025-22457 has been observed in the wild, with attackers using a shell script dropper to inject the BRUSHFIRE passive backdoor into a running web process.

Description: A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 9.8
Impact score: 5.9
Exploitability score: 3.9
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Severity: CRITICAL

Known exploits

Data from CISA

Vulnerability name: Ivanti Connect Secure, Policy Secure and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Exploit added on: Apr 4, 2025
Exploit action due: Apr 11, 2025
Required action: Apply mitigations as set forth in the CISA instructions linked below.

Weaknesses

3c1d8aa1-5a33-4ea4-8992-aadd6440af75: CWE-121
nvd@nist.gov: CWE-787

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 1

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:*:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A0EC2FCD-5402-4269-B86A-18F8DFB8F2C9",
            "versionEndExcluding": "22.7"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F788F6D9-5368-4B8E-BFA0-E8FB3CDADB01"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2927A40D-E8A3-4DB6-9C93-04A6C6035C3D"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1399BBB4-E62B-4FF6-B9E3-6AAC68D4D583"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1EAD1423-4477-4C35-BF93-697A2C0697C6"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "858353BC-12CB-4014-BFCA-DA7B1B3DD4B9"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "865F72BF-57B2-4B0C-BACE-3500E0AE6751"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "39E11407-E0C0-454F-B731-7DA4CBC696EB"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "247E71F8-A03B-4097-B7BF-09F8BF3ED4D6"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E0059C69-4A18-4153-9D9A-5C1B03AD1453"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FC523C88-115E-4CD9-A8CB-AE6E6610F7D4"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3447428E-DBCD-4553-B51D-AC08ECAFD881"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A08BAF98-7F05-4596-8BFC-91F1A79D3BD1"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "40717D97-A062-49C4-B105-C22AAC3A206A"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:-:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "0E4387B4-BC5C-41DE-92DA-84866A649AD2"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "24514B40-540E-45D7-90DC-BCC1D9D7E92C"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BFD510E9-12DC-4942-BAA0-6405CBD905EF"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.2:r5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "EA11BB6D-36C7-438B-A5A7-71C3CB2E5EC8"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "7B01001B-FA11-4297-AB81-12A00B97C820"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.3:r4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9F28E6B1-44AB-4635-8939-5B0A44BED1E6"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3E9D957B-49F9-492D-A66A-0D25BA27AD35"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.4:r3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D1AB497E-E403-4DEE-A83D-CB2E119E5E96"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CA6B3322-9AFB-44B5-B571-995AB606FD01"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.5:r1.2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "47CB7C12-D642-4015-842C-37241F87DB86"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "58E49DF1-F66A-4F52-87FA-A50DFD735ECB"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "62A0393A-C1C6-4708-BC41-5A5B8FB765FF"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1F3358B0-4751-4DCD-8BFC-BB4C68505658"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "5C9313A0-2F33-412B-A6F0-E51AE19E199B"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2979603E-F5CF-4C53-9828-36795E1B6247"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.6:r1.7:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D0D33C96-EE5C-41EB-8D9F-88ED025C191A"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9F0A44E1-3670-4AD5-A54D-FDA6C200AA73"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r1.2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C5B4CE43-2D9B-4DF9-AC2A-F649622CD190"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r1.3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3C9B3FF8-F613-404D-BC85-9DD6F2A6DB5C"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r1.4:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "CFC583B5-18F5-4943-8C68-6C601857CE5E"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r1.5:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6E4DE5D9-C92B-4143-835F-2D16F0CC328F"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r1.6:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F874F69E-C621-4C4B-802F-900E7BFAB71B"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "67D43D1D-564D-4ACD-B0FF-3828B95E9864"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2.2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BC8480E0-17C0-4590-950F-D3954E735365"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2.3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3FAF4FB0-A88C-4A87-B6CB-32EF7B415885"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.8:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "9779B197-1A14-4750-B8BC-9CA00F46D123"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.8:r1.1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "BAFF5CD8-AB78-436B-AA16-8447706D0E86"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.8:r2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2ADB0039-5652-428A-96A4-66B29DFB0F9D"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:policy_secure:*:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "48EFA63B-1322-45B0-B86D-87F24A2B4E8A",
            "versionEndExcluding": "22.7"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1F22B988-2585-4853-9838-AB3746C8B888"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "FD9BE8C2-43EB-4870-A4B7-267CB17A19F1"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C8915BB2-C1C0-4189-A847-DDB2EF161D62"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8D24A8DB-D697-4C60-935D-B08EE36861CB"
          },
          {
            "criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.3:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4C12D325-77E1-4873-8A77-D76F4A73BCF8"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]