Actively exploited · Published Jan 8, 2025 · Assigned by ivanti

CVE-2025-0282

Critical 9.0 Exploited Ransomware

In plain English

A critical-severity stack buffer overflow in Connect Secure from Ivanti. Attackers are actively exploiting it in the wild (listed by CISA on January 8, 2025). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 100.0% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

Severity (CVSS 3.1)9.0Critical

Exploit odds (30 days)100.0%top 0.0% of all CVEs

Exploited in the wildYesCISA KEV since Jan 8, 2025

Attack tooling2Nuclei, Public PoC

CISA guidance

Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

Federal agencies must remediate by Jan 15, 2025.

Official description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Affected products (as reported)

Vendor	Product	Versions
Ivanti	Connect Secure	22.7R2 – through 22.7R2.4
Ivanti	Policy Secure	22.7R1 – through 22.7R1.2
Ivanti	Neurons for ZTA gateways	22.7R2 – through 22.7R2.3

Weakness: CWE-121 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H