vuln2shell

CatalogIvanti Connect Secure

Ivanti Connect Secure RCE (CVE-2025-0282)

Single product ivanti-connect-secure

Unauthenticated stack-based buffer overflow RCE in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways. CVSS 9.0. Exploited as a zero-day from mid-Dec 2024 by UNC5221. Listed in CISA KEV on 8 Jan 2025.

PatchedKEVExploited
Aliases
CVE-2025-0282, CVE-2025-0283
Published
Updated

What the bug is

CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure before 22.7R2.5, Ivanti Policy Secure before 22.7R1.2, and Ivanti Neurons for ZTA gateways before 22.7R2.3. NVD scores it CVSS 3.1 9.0. A remote unauthenticated attacker can achieve remote code execution.

Ivanti disclosed the bug on 8 Jan 2025 alongside CVE-2025-0283. Ivanti reported a limited number of Connect Secure appliances exploited at disclosure, and said it was not aware of exploitation against Policy Secure or Neurons for ZTA gateways. Mandiant attributes the zero-day campaign to UNC5221 (suspected China-nexus), with exploitation beginning mid-December 2024 and malware families including PHASEJAM, DRYHOOK, and the SPAWN ecosystem.

Attack path

  1. Edge reachabilityUnauthenticated network access to an affected Ivanti Connect Secure, Policy Secure, or ZTA gateway.
  2. Stack overflowA crafted request triggers a stack-based buffer overflow (CVE-2025-0282).
  3. Code execAttacker code runs on the appliance. Conceptual impact class only.
  4. Appliance malwareObserved follow-on includes web shells, credential theft, log tampering, and SPAWN-family implants.

High-level only. Not a reproduction guide.

Exploitation status

CISA KEV

Listed in CISA KEV as of .

CISA KEV catalog

CISA KEV entry for CVE-2025-0282. dateAdded 2025-01-08. knownRansomwareCampaignUse Known.

First seen

Seen . Source: Mandiant

Mandiant identified zero-day exploitation of CVE-2025-0282 in the wild beginning mid-December 2024. Exact day not stated; mid-December used as the dated window.

What defenders should do today

Do today

  1. 1

    Patch to the fixed Ivanti releases

    Upgrade Connect Secure to 22.7R2.5 or later, Policy Secure to 22.7R1.2 or later, and Neurons for ZTA gateways to 22.7R2.3 or later per Ivanti's advisory.

    Ivanti security update

  2. 2

    Run integrity checking before and after patching

    Ivanti and Mandiant recommend the external Integrity Checker Tool (ICT). CISA says to factory-reset compromised or uncertain appliances, preferably from a known-clean image for cloud/virtual systems, then patch.

    CISA mitigation instructions

This week

  1. 1

    Threat-hunt connected identity systems

    CISA advises hunting systems connected to the affected appliance, monitoring authentication services, and auditing privileged accounts.

Ongoing

  1. 1

    Assume ICT is necessary but not sufficient

    Mandiant notes actors have tried to evade ICT, and Ivanti notes ICT is a point-in-time filesystem integrity check, not a malware scanner. Combine ICT with other monitoring.

Detection rules

SPL (Splunk)

  • Ivanti Connect Secure appliance stopped sending logs

    Log source: Ivanti Connect Secure syslog in Splunk

    | tstats latest(_time) as lastSeen where index=* by host sourcetype
| where match(sourcetype, "(?i)pulse|ivanti")
| eval minutesSilent=round((now()-lastSeen)/60,0)
| where minutesSilent > 60
| convert ctime(lastSeen)

    By vuln2shell, . Source. License: CC0 1.0

    Written by vuln2shell. Untested, tune before use.

    Mandiant observed malware on exploited appliances that blocks syslog forwarding and scrubs logs, so silence from a device that normally logs is worth a call. Adjust the sourcetype match and threshold.

KQL (Microsoft Sentinel / Defender)

  • Ivanti Connect Secure appliance stopped sending logs (Sentinel)

    Log source: Syslog via the Microsoft Sentinel Pulse Connect Secure solution parser

    PulseConnectSecure
| where TimeGenerated > ago(7d)
| summarize LastSeen = max(TimeGenerated) by Computer
| where LastSeen < ago(1h)

    By vuln2shell, . Source. License: CC0 1.0

    Written by vuln2shell. Untested, tune before use.

    Same idea as the SPL version. Uses the PulseConnectSecure parser function from the Sentinel solution.

Suricata / Snort

  • ET EXPLOIT Ivanti Connect Secure VPN IF-T/TLS clientCapabilities Remote Code Execution (CVE-2025-0282)

    Log source: Suricata TCP inspection of IF-T/TLS traffic

    alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:"ET EXPLOIT Ivanti Connect Secure VPN IF-T/TLS clientCapabilities Remote Code Execution (CVE-2025-0282)"; flow:established,to_server; xbits:isset,ET.IFTTLS.HTTPRequest,track ip_pair; content:"|00 00|"; startswith; pcre:"/^(\x0a\x4c|\x05\x83)\x00\x00\x00\x88/R"; content:"clientCapabilities|3d|"; fast_pattern; pcre:"/^[^\x20\x0a]{257,}/R"; reference:url,labs.watchtowr.com/do-secure-by-design-pledges-come-with-stickers-ivanti-connect-secure-rce-cve-2025-0282/; reference:cve,2025-0282; classtype:attempted-admin; sid:2059171; rev:1; metadata:affected_product Ivanti, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2025_01_13, cve CVE_2025_0282, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_01_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)

    By Emerging Threats (Proofpoint), . Source. License: BSD-3-Clause (ET Open, sids 2000000-2799999)

  • ET WEB_SPECIFIC_APPS Ivanti Connect Secure Host Checker Recon (CVE-2025-0282)

    Log source: Suricata IDS alerts (ET Open ruleset)

    alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"ET WEB_SPECIFIC_APPS Ivanti Connect Secure Host Checker Recon (CVE-2025-0282)"; flow:established,to_server; http.uri; content:"/dana-cached/hc/hc_launcher"; fast_pattern; pcre:"/^\x2e(?:\d+\x2e){4}jar/R"; reference:url,cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day; reference:cve,2025-0282; classtype:web-application-activity; sid:2059095; rev:1; metadata:affected_product Ivanti, attack_target Server, tls_state TLSDecrypt, created_at 2025_01_09, cve CVE_2025_0282, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Low, signature_severity Major, tag CISA_KEV, updated_at 2025_01_09, mitre_tactic_id TA0043, mitre_tactic_name Reconnaissance, mitre_technique_id T1590, mitre_technique_name Gather_Victim_Network_Information; target:dest_ip;)

    By Emerging Threats (Proofpoint), . Source. License: BSD-3-Clause (ET Open, sids 2000000-2799999)

    Matches the version-check request Mandiant describes before exploitation. Needs decrypted HTTP.

More detection content

Affected versions

Ivanti Connect Secure / Policy Secure / Neurons for ZTA gateways

Product version table
VersionStatusAdvisory
Ivanti Connect Secure < 22.7R2.5Affected

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5 ... allows a remote unauthenticated attacker to achieve remote code execution.

Source
Ivanti Policy Secure < 22.7R1.2Affected

Ivanti Policy Secure before version 22.7R1.2 ... allows a remote unauthenticated attacker to achieve remote code execution.

Source
Ivanti Neurons for ZTA gateways < 22.7R2.3Affected

Ivanti Neurons for ZTA gateways before version 22.7R2.3 ... allows a remote unauthenticated attacker to achieve remote code execution.

Source

Timeline6

Key events

Newest first.

  1. Advisory

    CISA updates mitigation instructions after identifying the RESURGE malware variant.

    Source
  2. PoC

    Rapid7 researcher Stephen Fewer publishes a public PoC repository.

    Source
  3. PoC

    watchTowr publishes an exploitation walkthrough for CVE-2025-0282.

    Source
  4. KEV

    Ivanti discloses CVE-2025-0282 and CVE-2025-0283 and ships patches. CISA adds CVE-2025-0282 to KEV.

    Source
  5. Advisory

    Mandiant publishes UNC5221 tradecraft covering PHASEJAM, DRYHOOK, and SPAWN malware.

    Source
  6. Exploited

    Mandiant places the start of UNC5221 zero-day exploitation in mid-December 2024.

    Source
Full timeline (6)
Fri 28 Mar 20251
  1. Advisory

    CISA updates mitigation instructions after identifying the RESURGE malware variant.

    Source
Thu 16 Jan 20251
  1. PoC

    Rapid7 researcher Stephen Fewer publishes a public PoC repository.

    Source
Sun 12 Jan 20251
  1. PoC

    watchTowr publishes an exploitation walkthrough for CVE-2025-0282.

    Source
Wed 8 Jan 20252
  1. KEV

    Ivanti discloses CVE-2025-0282 and CVE-2025-0283 and ships patches. CISA adds CVE-2025-0282 to KEV.

    Source
  2. Advisory

    Mandiant publishes UNC5221 tradecraft covering PHASEJAM, DRYHOOK, and SPAWN malware.

    Source
Sun 15 Dec 20241
  1. Exploited

    Mandiant places the start of UNC5221 zero-day exploitation in mid-December 2024.

    Source

News & write-ups

PoC index (for defenders)

Public proof-of-concept links for defensive validation, with a source and a validation status.

  • sfewer-r7/CVE-2025-0282Validated

    Source: Stephen Fewer (Rapid7). Validated

    Public PoC repository created 16 Jan 2025. Referenced from NVD. Description: PoC for CVE-2025-0282.

Open questions

No open questions recorded.

Original research

Email alerts coming soon

We’re not sending mail yet. Follow the catalog with RSS or the JSON feed.

Email alerts unavailable

Email signup is disabled until a mail provider is configured.

RSSJSON feed