{"id":"CVE-2025-0282","kind":"vulnerability","aliases":["CVE-2025-0282"],"related":[],"title":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version…","description":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.\n\nCISA required action: Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow in their web-facing code. An unauthenticated remote attacker can exploit it to run code on the gateway, and it is listed as exploited in the wild.","severity":"critical","cvss":9.0,"epss":null,"exploited":true,"exploited_at":"2025-01-08T00:00:00+00:00","products":[{"name":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"ivanti connect secure","fixed":[],"affected":"= 22.7","ecosystem":"vendor"},{"name":"ivanti neurons for zero-trust access","fixed":[],"affected":"= 22.7","ecosystem":"vendor"},{"name":"ivanti policy secure","fixed":[],"affected":"= 22.7","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["connect-secure","exploited","ivanti","policy-secure","ransomware","vendor","vpn","zta-gateway"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply the Ivanti updates and mitigations referenced in the CISA KEV entry, then hunt for compromise before returning the device to service.","status":"open","published_at":"2025-01-08T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:44+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"vendor","confidence":0.7,"triage":{"at":"2026-10-23T20:52:44Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Ivanti updates and mitigations referenced in the CISA KEV entry, then hunt for compromise before returning the device to service.\nunknown","reach":"internet","impact":"high","summary":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow in their web-facing code. An unauthenticated remote attacker can exploit it to run code on the gateway, and it is listed as exploited in the wild.","category":"vendor","who_cares":["ivanti","vpn","connect-secure","policy-secure","zta-gateway"],"confidence":0.7,"needs_auth":"no","worst_case":"Unauthenticated attacker runs code on the VPN gateway.","analyst_note":"Get the affected and fixed versions and Ivanti's specific mitigation and IOC hunt steps from the vendor advisory linked from the CISA KEV entry.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000467,"input_tokens":2724,"output_tokens":389,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0282':22A,25A '-2025':21A,24A '22.7':13A 'access':43A 'action':129C,148C 'activ':145C 'and':31A 'appli':130C,152C 'applic':150C 'attack':85B 'base':4A,73B,116C 'buffer':5A,74B,117C 'cisa':127C,137C 'code':81B,91B,125C 'conduct':143C 'connect':9A,27A,35A,48B,62B,105C 'connect-secur':47B 'contain':69B,112C 'cve':20A,23A 'devic':158C 'execut':126C 'exploit':50B,87B,100B 'face':80B 'for':39A 'forth':134C 'gateway':60B,68B,94B,111C 'gateways':33A 'hunt':144C 'includ':142C 'instruct':138C 'ivanti':8A,15A,26A,34A,37A,44A,51B,61B,104C 'lead':121C 'link':139C 'list':98B 'mitig':131C 'neurons':38A 'overflow':6A,75B,118C 'polici':16A,53B,64B,107C 'policy':29A,45A 'policy-secur':52B 'prior':154C 'r2.5':14A 'ransomwar':55B 'remedi':147C 'remot':84B,124C 'requir':128C 'return':156C 'run':90B 'secur':10A,17A,49B,54B,63B,65B,106C,108C 'secure':28A,30A,36A,46A 'servic':160C 'set':133C 'stack':3A,72B,115C 'stack-bas':2A,71B,114C 'take':146C 'trust':42A 'unauthent':83B,123C 'updat':153C 'vendor':56B 'version':12A,19A 'vpn':57B 'web':79B 'web-fac':78B 'wild':103B 'zero':41A 'zero-trust':40A 'zta':32A,59B,67B,110C 'zta-gateway':58B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2025-01-08T00:00:00+00:00","kev":{"dateAdded":"2025-01-08","dueDate":"2025-01-15","requiredAction":"Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","cvss_by":"3c1d8aa1-5a33-4ea4-8992-aadd6440af75","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2025-0282","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0282","severity":null,"published_at":"2025-01-08T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T12:39:22+00:00","note":null},{"source":"nvd","external_id":"CVE-2025-0282","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","severity":null,"published_at":"2025-01-08T23:15:09+00:00","modified_at":"2026-10-01T19:17:15+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}