{"slug":"ivanti-connect-secure","title":"Ivanti Connect Secure RCE (CVE-2025-0282)","shortName":"Ivanti Connect Secure","summary":"Unauthenticated stack-based buffer overflow RCE in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways. CVSS 9.0. Exploited as a zero-day from mid-Dec 2024 by UNC5221. Listed in CISA KEV on 8 Jan 2025.","isExample":false,"draft":false,"family":"ivanti-connect-secure","kind":"single-product","aliases":["CVE-2025-0282","CVE-2025-0283"],"publishedAt":"2025-01-08","updatedAt":"2026-10-24","patchStatus":"patched","exploited":true,"scores":{"cve":"CVE-2025-0282","cvss":{"cve":"CVE-2025-0282","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","version":"3.1","scorer":"nvd","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","sourceDate":"2026-10-01","checkedDate":"2026-10-24"},"epss":{"cve":"CVE-2025-0282","score":0.99981,"percentile":0.99982,"date":"2026-10-23","sourceUrl":"https://api.first.org/data/v1/epss?cve=CVE-2025-0282","checkedDate":"2026-10-24"},"kev":{"cve":"CVE-2025-0282","listed":true,"dateAdded":"2025-01-08","dueDate":"2025-01-15","catalogVersion":"2026.10.23","sourceUrl":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","checkedDate":"2026-10-24"},"addedDate":"2026-10-24"},"priority":{"label":"act-now"},"managementSummary":{"what":"Unauthenticated buffer-overflow remote code execution in Ivanti Connect Secure and related gateways (CVE-2025-0282). Exploited as a zero-day from December 2024 and listed in CISA KEV.","action":"Confirm appliances are on Ivanti's fixed releases, run the integrity checker, and hunt connected identity systems if the device was exposed while vulnerable."},"seenInTheWild":[{"metric":"possibly-vulnerable","value":"around 2000 exposed unpatched devices (IPs)","observer":"Shadowserver","date":"2025-01-09","method":"Shadowserver vulnerable HTTP scan","sourceUrl":"https://infosec.exchange/@shadowserver/113821229681757140"},{"metric":"possibly-vulnerable","value":"around 800 exposed unpatched devices (IPs)","observer":"Shadowserver","date":"2025-01-12","method":"Shadowserver vulnerable HTTP scan","sourceUrl":"https://infosec.exchange/@shadowserver/113821229681757140"},{"metric":"exposed","value":33542,"observer":"Censys","date":"2025-01-10","method":"Exposed Ivanti Connect Secure instances, not all vulnerable","sourceUrl":"https://censys.com/advisory/cve-2025-0282/"},{"metric":"possibly-vulnerable","value":12335,"observer":"Censys","date":"2025-01-13","method":"Instances showing indications of a version earlier than 22.7R2.5 (\"potentially vulnerable\")","sourceUrl":"https://censys.com/advisory/cve-2025-0282/"},{"metric":"exposed","value":5903,"observer":"Shodan","date":"2026-10-23","method":"Product query http.title:\"Ivanti Connect Secure\"","sourceUrl":"https://www.shodan.io/search?query=http.title%3A%22Ivanti%20Connect%20Secure%22","note":"Exposed hosts. Data: Shodan."},{"metric":"exploitation-confirmed","value":"Listed","observer":"CISA","date":"2025-01-08","method":"CISA Known Exploited Vulnerabilities catalog dateAdded","sourceUrl":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog"}],"seenInTheWildLinks":[{"title":"Shadowserver dashboard","url":"https://dashboard.shadowserver.org/statistics/combined/time-series/?date_range=7&source=http_vulnerable&source=http_vulnerable6&tag=cve-2025-0282%2B&dataset=unique_ips&style=stacked","observer":"Shadowserver","metric":"possibly-vulnerable"},{"title":"Ivanti Connect Secure CVE-2025-0282 RCE Attempt","url":"https://viz.greynoise.io/tags/ivanti-connect-secure-cve-2025-0282-rce-attempt","observer":"GreyNoise","metric":"scanning"},{"title":"Ivanti Connect Secure Stack Buffer Overflow CVE-2025-0282 RCE Check","url":"https://viz.greynoise.io/tags/ivanti-connect-secure-stack-buffer-overflow-cve-2025-0282-rce-check","observer":"GreyNoise","metric":"scanning"}],"whatChanged":{"date":"2026-10-24","items":[{"text":"Added Am I affected checks, mitigations and response guidance","section":"am-i-affected"},{"text":"Act-now priority block with sourced CVSS, EPSS, and CISA KEV dates.","section":"priority","addedDate":"2026-10-24"},{"text":"Detection rule coverage table and JSON, IOC CSV, and STIX feeds.","section":"detection","addedDate":"2026-10-24"}]},"whatTheBugIs":"CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure before 22.7R2.5, Ivanti Policy Secure before 22.7R1.2, and Ivanti Neurons for ZTA gateways before 22.7R2.3. NVD scores it CVSS 3.1 9.0. A remote unauthenticated attacker can achieve remote code execution.\n\nIvanti disclosed the bug on 8 Jan 2025 alongside CVE-2025-0283. Ivanti reported a limited number of Connect Secure appliances exploited at disclosure, and said it was not aware of exploitation against Policy Secure or Neurons for ZTA gateways. Mandiant attributes the zero-day campaign to UNC5221 (suspected China-nexus), with exploitation beginning mid-December 2024 and malware families including PHASEJAM, DRYHOOK, and the SPAWN ecosystem.","attackPath":{"caption":"High-level only. Not a reproduction guide.","steps":[{"id":"reach","label":"Edge reachability","detail":"Unauthenticated network access to an affected Ivanti Connect Secure, Policy Secure, or ZTA gateway."},{"id":"overflow","label":"Stack overflow","detail":"A crafted request triggers a stack-based buffer overflow (CVE-2025-0282)."},{"id":"exec","label":"Code exec","detail":"Attacker code runs on the appliance. Conceptual impact class only."},{"id":"persist","label":"Appliance malware","detail":"Observed follow-on includes web shells, credential theft, log tampering, and SPAWN-family implants."}]},"exploitation":{"kev":{"listed":true,"date":"2025-01-08","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","note":"CISA KEV entry for CVE-2025-0282. dateAdded 2025-01-08. knownRansomwareCampaignUse Known."},"firstSeen":{"date":"2024-12-15","source":"Mandiant","note":"Mandiant identified zero-day exploitation of CVE-2025-0282 in the wild beginning mid-December 2024. Exact day not stated; mid-December used as the dated window."},"vendorStatements":[{"vendor":"Ivanti","date":"2025-01-08","statement":"We are aware of a limited number of customers' Ivanti Connect Secure appliances which have been exploited by CVE-2025-0282 at the time of disclosure. We are not aware of these CVEs being exploited in Ivanti Policy Secure or Neurons for ZTA gateways.","url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","retracted":false},{"vendor":"Mandiant","date":"2025-01-08","statement":"Mandiant has identified zero-day exploitation of CVE-2025-0282 in the wild beginning mid-December 2024. Mandiant attributes the activity to UNC5221.","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","retracted":false}]},"timeline":[{"date":"2024-12-15","event":"Mandiant places the start of UNC5221 zero-day exploitation in mid-December 2024.","source":{"title":"Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","publisher":"Mandiant"},"kind":"exploited","key":true},{"date":"2025-01-08","event":"Ivanti discloses CVE-2025-0282 and CVE-2025-0283 and ships patches. CISA adds CVE-2025-0282 to KEV.","source":{"title":"Security Update: Ivanti Connect Secure, Policy Secure and Neurons for ZTA Gateways","url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","publisher":"Ivanti"},"kind":"kev","key":true},{"date":"2025-01-08","event":"Mandiant publishes UNC5221 tradecraft covering PHASEJAM, DRYHOOK, and SPAWN malware.","source":{"title":"Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","publisher":"Mandiant"},"kind":"advisory","key":true},{"date":"2025-01-12","event":"watchTowr publishes an exploitation walkthrough for CVE-2025-0282.","source":{"title":"Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE","url":"https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","publisher":"watchTowr"},"kind":"poc","key":true},{"date":"2025-01-16","event":"Rapid7 researcher Stephen Fewer publishes a public PoC repository.","source":{"title":"sfewer-r7/CVE-2025-0282","url":"https://github.com/sfewer-r7/CVE-2025-0282","publisher":"Rapid7"},"kind":"poc","key":true},{"date":"2025-03-28","event":"CISA updates mitigation instructions after identifying the RESURGE malware variant.","source":{"title":"CISA Mitigation Instructions for CVE-2025-0282","url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","publisher":"CISA"},"kind":"advisory","key":true}],"defenderActions":[{"title":"Patch to the fixed Ivanti releases","detail":"Upgrade Connect Secure to 22.7R2.5 or later, Policy Secure to 22.7R1.2 or later, and Neurons for ZTA gateways to 22.7R2.3 or later per Ivanti's advisory.","priority":"now","links":[{"label":"Ivanti security update","href":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways"}]},{"title":"Run integrity checking before and after patching","detail":"Ivanti and Mandiant recommend the external Integrity Checker Tool (ICT). CISA says to factory-reset compromised or uncertain appliances, preferably from a known-clean image for cloud/virtual systems, then patch.","priority":"now","links":[{"label":"CISA mitigation instructions","href":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282"}]},{"title":"Threat-hunt connected identity systems","detail":"CISA advises hunting systems connected to the affected appliance, monitoring authentication services, and auditing privileged accounts.","priority":"soon"},{"title":"Assume ICT is necessary but not sufficient","detail":"Mandiant notes actors have tried to evade ICT, and Ivanti notes ICT is a point-in-time filesystem integrity check, not a malware scanner. Combine ICT with other monitoring.","priority":"monitor"}],"detection":[{"title":"Integrity Checker Tool failures","detail":"Ivanti ICT unsuccessful scans (limited steps performed versus a clean successful scan) are a primary compromise indicator on these appliances.","logSource":"Ivanti Integrity Checker Tool output","kind":"generic"},{"title":"PHASEJAM / SPAWN host artifacts","detail":"Mandiant documents PHASEJAM dropper paths such as /tmp/s, modifications under jam/getComponent.cgi, credential theft tooling (DRYHOOK), and SPAWN-family implants that can block syslog forwarding and scrub logs.","logSource":"EDR / process telemetry","kind":"generic","group":"edr"},{"title":"Missing or abnormal syslog from the appliance","detail":"Mandiant observed malware that prevents syslog forwarding and removes debug/application log entries. Sudden silence from a previously logging VPN appliance is investigative.","logSource":"SIEM / syslog pipeline","kind":"generic","group":"web-proxy"},{"title":"Cloudflare WAF Managed Rules: 100722","detail":"Rule 100722 (...b2a51e3d) 'Ivanti - Information Disclosure - CVE:CVE-2025-0282', released 2025-03-10.","logSource":"Cloudflare Security Events / Firewall events","kind":"vendor-signature","url":"https://developers.cloudflare.com/changelog/post/2025-03-10-waf-release/","date":"2025-03-10"},{"title":"F5 attack signature: 200011098","detail":"Ivanti Connect Secure Buffer Overflow (200011098), references CVE-2025-0282, last update 2025-01-23.","logSource":"F5 Advanced WAF / Distributed Cloud WAF event logs","kind":"vendor-signature","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2025-01-23"},{"title":"Check Point IPS: CPAI-2025-0002","detail":"Protection 'Ivanti Buffer Overflow (CVE-2025-0282)', published 2025-01-13.","logSource":"Check Point IPS logs (SmartConsole / Logs & Monitor)","kind":"vendor-signature","url":"https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0002.html/","date":"2025-01-13"},{"title":"Fortinet FortiGuard IPS: 57117","detail":"IPS signature Ivanti.Connect.Secure.CVE-2025-0282.Buffer.Overflow (57117), 2025-01-13.","logSource":"FortiGate IPS logs","kind":"vendor-signature","url":"https://www.fortiguard.com/search?q=CVE-2025-0282&engine=1","date":"2025-01-13"},{"title":"Juniper IDP: HTTP:CTS:IVNTI-CS-RCE, HTTP:CTS:IVNTI-MP-CS-RCE","detail":"IDP signatures for CVE-2025-0282, release dates 2025-01-16 and 2025-02-25.","logSource":"Juniper SRX IDP logs","kind":"vendor-signature","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:IVNTI-CS-RCE.html","date":"2025-01-16"},{"title":"Palo Alto Networks Threat Prevention: 95948","detail":"Threat ID 95948 for CVE-2025-0282 per Unit 42 threat brief.","logSource":"Palo Alto Networks threat logs (Threat Prevention / NGFW)","kind":"vendor-signature","url":"https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2025-0283/","date":"2025-01-16"},{"title":"Sophos Firewall IPS: Ivanti Multiple Products CVE-2025-0282 Buffer Overflow","detail":"Listed in IPS release 18.22.92 (2025-01-22). No SID in the notes.","logSource":"Sophos Firewall IPS logs","kind":"vendor-signature","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.22.92.html","date":"2025-01-22"},{"title":"Trend Micro TippingPoint 45362","detail":"Digital Vaccine #9992 filter 45362 'TCP: Ivanti Multiple Products Buffer Overflow Vulnerability' references CVE-2025-0282, release date 2025-02-04.","logSource":"Trend Micro TippingPoint SMS event logs","kind":"vendor-signature","url":"https://success.trendmicro.com/en-US/solution/KA-0018976","date":"2025-02-04","dateKind":"checked"}],"detectionRules":[{"id":"et-ivanti-ift-tls-clientcapabilities","title":"ET EXPLOIT Ivanti Connect Secure VPN IF-T/TLS clientCapabilities Remote Code Execution (CVE-2025-0282)","language":"suricata","query":"alert tcp $EXTERNAL_NET any -> $HOME_NET any (msg:\"ET EXPLOIT Ivanti Connect Secure VPN IF-T/TLS clientCapabilities Remote Code Execution (CVE-2025-0282)\"; flow:established,to_server; xbits:isset,ET.IFTTLS.HTTPRequest,track ip_pair; content:\"|00 00|\"; startswith; pcre:\"/^(\\x0a\\x4c|\\x05\\x83)\\x00\\x00\\x00\\x88/R\"; content:\"clientCapabilities|3d|\"; fast_pattern; pcre:\"/^[^\\x20\\x0a]{257,}/R\"; reference:url,labs.watchtowr.com/do-secure-by-design-pledges-come-with-stickers-ivanti-connect-secure-rce-cve-2025-0282/; reference:cve,2025-0282; classtype:attempted-admin; sid:2059171; rev:1; metadata:affected_product Ivanti, attack_target Networking_Equipment, tls_state TLSDecrypt, created_at 2025_01_13, cve CVE_2025_0282, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Medium, signature_severity Major, tag Exploit, tag CISA_KEV, updated_at 2025_01_13, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access, mitre_technique_id T1190, mitre_technique_name Exploit_Public_Facing_Application; target:dest_ip;)","logSource":"Suricata TCP inspection of IF-T/TLS traffic","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-exploit.rules","sourceDate":"2025-01-13","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","tested":"untested"},{"id":"et-ivanti-host-checker-recon","title":"ET WEB_SPECIFIC_APPS Ivanti Connect Secure Host Checker Recon (CVE-2025-0282)","language":"suricata","query":"alert http $EXTERNAL_NET any -> $HOME_NET any (msg:\"ET WEB_SPECIFIC_APPS Ivanti Connect Secure Host Checker Recon (CVE-2025-0282)\"; flow:established,to_server; http.uri; content:\"/dana-cached/hc/hc_launcher\"; fast_pattern; pcre:\"/^\\x2e(?:\\d+\\x2e){4}jar/R\"; reference:url,cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day; reference:cve,2025-0282; classtype:web-application-activity; sid:2059095; rev:1; metadata:affected_product Ivanti, attack_target Server, tls_state TLSDecrypt, created_at 2025_01_09, cve CVE_2025_0282, deployment Perimeter, deployment Internal, deployment SSLDecrypt, confidence Low, signature_severity Major, tag CISA_KEV, updated_at 2025_01_09, mitre_tactic_id TA0043, mitre_tactic_name Reconnaissance, mitre_technique_id T1590, mitre_technique_name Gather_Victim_Network_Information; target:dest_ip;)","logSource":"Suricata IDS alerts (ET Open ruleset)","author":"Emerging Threats (Proofpoint)","authorUrl":"https://rules.emergingthreats.net/","sourceUrl":"https://rules.emergingthreats.net/open/suricata-7.0.3/rules/emerging-web_specific_apps.rules","sourceDate":"2025-01-09","license":"BSD-3-Clause (ET Open, sids 2000000-2799999)","origin":"vendor","notes":"Matches the version-check request Mandiant describes before exploitation. Needs decrypted HTTP.","tested":"untested"},{"id":"v2s-spl-ivanti-log-silence","title":"Ivanti Connect Secure appliance stopped sending logs","language":"spl","query":"| tstats latest(_time) as lastSeen where index=* by host sourcetype\n| where match(sourcetype, \"(?i)pulse|ivanti\")\n| eval minutesSilent=round((now()-lastSeen)/60,0)\n| where minutesSilent > 60\n| convert ctime(lastSeen)","logSource":"Ivanti Connect Secure syslog in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08","license":"CC0 1.0","origin":"vuln2shell","notes":"Mandiant observed malware on exploited appliances that blocks syslog forwarding and scrubs logs, so silence from a device that normally logs is worth a call. Adjust the sourcetype match and threshold.","tested":"untested"},{"id":"v2s-kql-ivanti-log-silence","title":"Ivanti Connect Secure appliance stopped sending logs (Sentinel)","language":"kql","query":"PulseConnectSecure\n| where TimeGenerated > ago(7d)\n| summarize LastSeen = max(TimeGenerated) by Computer\n| where LastSeen < ago(1h)","logSource":"Syslog via the Microsoft Sentinel Pulse Connect Secure solution parser","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08","license":"CC0 1.0","origin":"vuln2shell","notes":"Same idea as the SPL version. Uses the PulseConnectSecure parser function from the Sentinel solution.","tested":"untested"}],"detectionLinks":[{"title":"Mandiant: Ivanti Connect Secure VPN targeted in new zero-day exploitation","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","author":"Mandiant (Google Threat Intelligence)","date":"2025-01-08","note":"Includes YARA rules for PHASEJAM, SPAWN-family and DRYHOOK. No licence stated and the rules are long, so linked, not copied."},{"title":"CISA mitigation instructions for CVE-2025-0282","url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","author":"CISA","date":"2025-01-08","note":"Integrity Checker Tool (internal and external) guidance."},{"title":"watchTowr: Ivanti Connect Secure RCE CVE-2025-0282 walkthrough","url":"https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","author":"watchTowr Labs","date":"2025-01-12"}],"retrohunt":{"summary":"Treat mid-December 2024 as the start of the window. Run the external Integrity Checker Tool, hunt PHASEJAM and SPAWN host paths, and look for syslog silence from appliances that used to log.","lookback":{"from":"2024-12-15","basis":"first-exploitation","rationale":"Mandiant places UNC5221 zero-day exploitation of CVE-2025-0282 in mid-December 2024. Exact day not stated; this page uses 15 Dec 2024 as the start of that window.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"}]},"logSources":[{"name":"Ivanti Integrity Checker Tool (external ICT) output","why":"Primary compromise indicator on the appliance.","required":true},{"name":"Syslog from the appliance","why":"SPAWN-family implants can block forwarding and scrub logs. Sudden silence is a signal.","required":true},{"name":"Authentication logs of systems behind the VPN","why":"CISA says to hunt connected identity systems.","required":true},{"name":"Disk / filesystem snapshots of the appliance","why":"PHASEJAM and SPAWN leave host artefacts Mandiant documents.","required":true}],"steps":[{"title":"Run the external ICT and keep the report","detail":"Ivanti and Mandiant recommend the external Integrity Checker Tool. Unsuccessful or limited scans are a compromise indicator. ICT is a point-in-time filesystem check, not a malware scanner.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"},{"url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","date":"2025-03-28","publisher":"CISA"}]},{"title":"Hunt PHASEJAM and SPAWN artefacts","detail":"Mandiant documents PHASEJAM dropper paths such as /tmp/s, modifications under jam/getComponent.cgi, credential theft tooling (DRYHOOK), and SPAWN-family implants.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"}]},{"title":"Check for syslog silence","detail":"Compare expected vs actual syslog volume from each appliance from mid-December 2024. Malware that stops forwarding leaves a gap.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"}]},{"title":"Hunt connected identity systems","detail":"CISA advises hunting systems connected to the appliance, monitoring authentication services and auditing privileged accounts.","sources":[{"url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","date":"2025-03-28","publisher":"CISA"}]}],"queries":[{"id":"v2s-rh-spl-ivanti-silence","title":"Ivanti / Pulse syslog silence since mid-December 2024","language":"spl","query":"| tstats latest(_time) as lastSeen where index=* earliest=\"12/15/2024:00:00:00\" by host sourcetype\n| where match(sourcetype, \"(?i)pulse|ivanti\")\n| eval minutesSilent=round((now()-lastSeen)/60,0)\n| where minutesSilent > 60\n| convert ctime(lastSeen)","logSource":"Ivanti Connect Secure syslog in Splunk","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08","license":"CC0 1.0","origin":"vuln2shell","notes":"A host that has never logged will always look silent; only alert on hosts that used to log.","tested":"untested","timeRange":"From 2024-12-15"},{"id":"v2s-rh-kql-ivanti-silence","title":"Ivanti syslog silence since mid-December 2024","language":"kql","query":"PulseConnectSecure\n| where TimeGenerated >= datetime(2024-12-15)\n| summarize LastSeen = max(TimeGenerated), Events = count() by Computer\n| where LastSeen < ago(1h) and Events > 0","logSource":"Syslog via the Microsoft Sentinel Pulse Connect Secure solution parser","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2024-12-15, limited by retention"},{"id":"v2s-rh-logscale-ivanti-silence","title":"Ivanti syslog silence","language":"logscale","query":"// Set the time picker to start 2024-12-15; filter to Ivanti/Pulse sources first\n| groupBy([#host], function=[count(as=events), max(@timestamp, as=lastSeen)])\n| events > 0\n| lastSeen < now() - 3600000","logSource":"Ivanti syslog in LogScale","author":"vuln2shell","authorUrl":"https://vuln2shell.com","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08","license":"CC0 1.0","origin":"vuln2shell","tested":"untested","timeRange":"From 2024-12-15"}],"thirdPartyQueries":[{"title":"CISA mitigation instructions for CVE-2025-0282","url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","author":"CISA","date":"2025-03-28","language":"guide","license":"public","origin":"vendor","note":"Includes factory-reset and hunting guidance."},{"title":"Mandiant PHASEJAM / SPAWN analysis","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","author":"Mandiant","date":"2025-01-08","language":"guide","license":"public","origin":"vendor","note":"Host paths and log-scrubbing behaviour."}],"artefacts":[{"kind":"file","value":"/tmp/s","detail":"PHASEJAM dropper path.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"file","value":"jam/getComponent.cgi modifications","detail":"PHASEJAM persistence.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"device-log","value":"Missing or scrubbed syslog after mid-December 2024","detail":"SPAWN-family log interference.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"report","value":"External ICT unsuccessful or limited scan","detail":"Primary compromise indicator.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"}],"iocs":[],"iocNote":"Mandiant published hashes and paths for PHASEJAM, DRYHOOK and SPAWN in its 8 Jan 2025 post. Use that list.","hitMeaning":[{"level":"attempt","detail":"Scanning of the appliance with a clean ICT report and normal syslog."},{"level":"likely-compromise","detail":"Failed or limited ICT, or syslog silence from a previously logging appliance."},{"level":"confirmed-compromise","detail":"PHASEJAM, SPAWN or other Mandiant-documented artefacts. Factory-reset before patching."}],"nextSteps":[{"title":"Factory-reset, then patch","detail":"CISA says to factory-reset compromised or uncertain appliances, preferably from a known-clean image for cloud or virtual systems, then patch.","links":[{"label":"CISA instructions","href":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282"},{"label":"Ivanti advisory","href":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways"}]},{"title":"Assume credential theft","detail":"Rotate VPN, LDAP and any credentials stored on the appliance. Hunt identity systems behind it."}],"limits":["ICT can be evaded; Mandiant says actors have tried.","Appliances that never forwarded syslog have no silence signal."],"sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"},{"url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","date":"2025-03-28","publisher":"CISA"},{"url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","date":"2025-01-08","publisher":"Ivanti"}],"updatedAt":"2026-10-24"},"amIAffected":{"summary":"Ivanti Connect Secure before 22.7R2.5, Policy Secure before 22.7R1.2, and Neurons for ZTA gateways before 22.7R2.3 are in scope for CVE-2025-0282. Ivanti reported limited Connect Secure exploitation at disclosure and said it was not aware of exploitation against Policy Secure or ZTA gateways. That is not a not-affected statement for those products.","checks":[{"id":"v2s-aia-ivanti-connect-secure-version-1","kind":"version","title":"Read the appliance version against the first-fixed builds","detail":"NVD and Ivanti: Connect Secure before 22.7R2.5, Policy Secure before 22.7R1.2, Neurons for ZTA gateways before 22.7R2.3. CERT-EU (2025-001) listed ICS 22.7R2 through 22.7R2.4 as the then-patched ICS range. Read the version from the admin console or ICT report. No public CLI version string was copied from Ivanti docs in this pass.","command":"In the Connect Secure / Policy Secure / ZTA admin console, record the installed version string and compare to 22.7R2.5 (ICS), 22.7R1.2 (Policy Secure), 22.7R2.3 (ZTA gateways).","affectedMeans":"ICS < 22.7R2.5, Policy Secure < 22.7R1.2, or ZTA gateways < 22.7R2.3. CERT-EU also noted ICS 9.x reached end of life 2024-12-31 and would not receive a CVE-2025-0283 patch.","fixedMeans":"ICS 22.7R2.5 or later, Policy Secure 22.7R1.2 or later, ZTA gateways 22.7R2.3 or later, after ICT review and, if required, factory reset from a known-clean image.","sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","date":"2025-01-08","publisher":"NVD"},{"url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","date":"2025-01-08","publisher":"Ivanti"},{"url":"https://cert.europa.eu/publications/security-advisories/2025-001","date":"2025-01-08","publisher":"CERT-EU"}]},{"id":"v2s-aia-ivanti-connect-secure-config-2","kind":"config","title":"Run the external Integrity Checker Tool as a point-in-time inventory of integrity","detail":"Ivanti and Mandiant: use external and internal ICT. Mandiant: unsuccessful scans show a limited number of steps versus a clean successful scan. Ivanti: ICT is a snapshot, not a malware scanner, and cannot necessarily detect activity if the appliance was returned to a clean state. Mandiant observed actors recalculating SHA-256 hashes in the ICT manifest to evade it.","command":"Run the Ivanti external ICT per Ivanti instructions and keep the full report. Compare step count to a known-clean successful scan as Mandiant describes.","affectedMeans":"Unsuccessful or limited-step ICT, or any Mandiant-documented host artefact. A clean ICT does not prove the device was never compromised.","fixedMeans":"Successful full-step ICT after a factory reset from a known-clean image and install of 22.7R2.5 / 22.7R1.2 / 22.7R2.3.","notes":"NCSC 2025-01-08 repeats: run external ICT, then compromise assessment using Mandiant IOCs.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"},{"url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","date":"2025-01-08","publisher":"Ivanti"},{"url":"https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerability","date":"2025-01-08","publisher":"NCSC"}]},{"id":"v2s-aia-ivanti-connect-secure-exposure-3","kind":"exposure","title":"Internet-facing Ivanti Connect Secure in your ranges","detail":"Catalog Shodan query http.title:\"Ivanti Connect Secure\". Censys 2025-01-10/13 counts are global. CERT-EU and NCSC: Policy Secure should not be internet facing.","command":"shodan search 'http.title:\"Ivanti Connect Secure\" net:<your-range>'","affectedMeans":"An ICS (or unexpectedly public Policy Secure) title in your net or org whose version is below the first-fixed build.","fixedMeans":"No public ICS management/VPN listener you did not intend, and every intended appliance is on the first-fixed build after ICT/reset.","sources":[{"url":"https://www.shodan.io/search?query=http.title%3A%22Ivanti%20Connect%20Secure%22","date":"2026-10-23","publisher":"Shodan (catalog snapshot)"},{"url":"https://censys.com/advisory/cve-2025-0282/","date":"2025-01-10","publisher":"Censys"},{"url":"https://cert.europa.eu/publications/security-advisories/2025-001","date":"2025-01-08","publisher":"CERT-EU"}]}],"limits":["A clean ICT is point-in-time and can be evaded (Mandiant).","Ivanti 'not aware of exploitation' for Policy Secure and ZTA is not a not-affected statement.","Version-specific exploitation (Mandiant) means a banner alone does not prove exploitability of a given build."],"sources":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","date":"2025-01-08","publisher":"NVD"},{"url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","date":"2025-01-08","publisher":"Ivanti"},{"url":"https://cert.europa.eu/publications/security-advisories/2025-001","date":"2025-01-08","publisher":"CERT-EU"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"},{"url":"https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerability","date":"2025-01-08","publisher":"NCSC"},{"url":"https://www.shodan.io/search?query=http.title%3A%22Ivanti%20Connect%20Secure%22","date":"2026-10-23","publisher":"Shodan (catalog snapshot)"},{"url":"https://censys.com/advisory/cve-2025-0282/","date":"2025-01-10","publisher":"Censys"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"mitigations":{"summary":"Ivanti and CISA tell you to patch and, if compromise is suspected, factory-reset. No vendor config workaround that blocks the overflow was published when this page was checked.","items":[],"nonePublished":{"statement":"No vendor mitigation published; patch is the only fix","checkedDate":"2026-10-24","sources":[{"url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","date":"2025-01-08","publisher":"Ivanti"},{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-01-08","publisher":"CISA"}]},"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"response":{"summary":"Run the Integrity Checker Tool, then factory-reset compromised or uncertain appliances from a known-clean image and patch. Mandiant notes actors have tried to evade ICT. Hunt connected identity systems and rotate privileged accounts.","containment":[{"title":"If hunting finds compromise, disconnect the appliance","detail":"CISA: disconnect instances of affected Ivanti Connect Secure products; isolate systems from enterprise resources to the greatest degree possible; report to CISA and Ivanti.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-01-08","publisher":"CISA"}]},{"title":"Factory reset from a known-clean image, then patch","detail":"CISA (updated 2025-04-08 for RESURGE): for highest confidence, factory reset. For cloud and virtual systems, use an external known-clean image. Then apply the Ivanti patch. Ivanti/Mandiant: if ICT shows compromise, factory reset and return to production on 22.7R2.5. NCSC: vendor recommends factory reset before installing updates.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-04-08","publisher":"CISA"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"},{"url":"https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerability","date":"2025-01-08","publisher":"NCSC"}]},{"title":"Hunt systems behind the VPN before trusting the reset","detail":"CISA: threat hunt on systems connected to, or recently connected to, the affected Ivanti device. Mandiant: LDAP service account used for LDAP queries and lateral movement via SMB or RDP; appliance cache may hold session cookies, API keys, certificates, and credential material.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-01-08","publisher":"CISA"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"}]}],"rotate":[{"item":"Admin enable password, stored API keys, and every local user password on the gateway (including auth-server service accounts)","reason":"CISA explicit rotate list after compromise. Mandiant: cache dump of /runtime/mtmp/lmdb may contain session cookies, API keys, certificates, and credential material. Ivanti previously published guidance to reset local accounts, API keys, and revoke certificates after cache theft.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-01-08","publisher":"CISA"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"}]},{"item":"Connected or exposed certificates and keys","reason":"CISA: revoke and reissue any connected or exposed certificates, keys, and passwords.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-01-08","publisher":"CISA"}]},{"item":"Domain accounts associated with the appliance (reset twice, revoke Kerberos, revoke cloud tokens)","reason":"CISA: if domain accounts associated with the affected products have been compromised, reset passwords twice for on-prem accounts, revoke Kerberos tickets, then revoke tokens for cloud accounts in hybrid deployments. Disable cloud-joined devices to revoke device tokens. Mandiant: DRYHOOK harvests successful authentications via DSAuth.pm into /tmp/cmdmmap.kuwMW.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-01-08","publisher":"CISA"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"}]}],"persistence":[{"kind":"path","value":"/tmp/s","detail":"PHASEJAM dropper. Mandiant IOC table.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"path","value":"/tmp/.t and /tmp/svb","detail":"Mandiant: Base64 script echoed to /tmp/.t; ELF helper /tmp/svb then wiped with dd.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"webshell","value":"/home/webserver/htdocs/dana-na/jam/getComponent.cgi (AccessAllow)","detail":"PHASEJAM inserts a Perl webshell function into getComponent.cgi and restAuth.cgi, then rewrites hashes in /home/etc/manifest/manifest.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"webshell","value":"/home/webserver/htdocs/dana-na/auth/restAuth.cgi","detail":"Second PHASEJAM webshell path. Backups getComponent.cgi.bak and restAuth.cgi.bak also noted.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"path","value":"/home/bin/remotedebug (and remotedebug.bak)","detail":"PHASEJAM replaces remotedebug with a wrapper that executes -c as a shell.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"path","value":"/home/perl/DSUpgrade.pm (processUpgradeDisplay fake upgrade)","detail":"Blocks real upgrades and shows a fake 13-step HTML progress bar. Manifest hash updated to evade ICT.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"path","value":"/home/perl/DSAuth.pm plus /tmp/cmdmmap.kuwMW","detail":"DRYHOOK credential harvester writes successful logons after RC4 and Base64.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"path","value":"SPAWNANT /root/lib/libupgrade.so ; SPAWNMOLE /root/home/lib/libsocks5.so ; SPAWNSNAIL /root/home/lib/libsshd.so ; SPAWNSLOTH /tmp/.liblogblock.so","detail":"SPAWN family installer, tunneler, SSH backdoor, log-tamper. Persist across upgrades via dspkginstall hijack and LD_PRELOAD. Also writes a webshell into compcheckresult.cgi on the upgrade partition.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"},{"kind":"other","value":"Tar of /runtime/mtmp/lmdb staged as a CSS file under /home/webserver/htdocs/dana-na/css/","detail":"Mandiant: database cache theft for sessions, cookies, API keys, certificates, credentials.","sourceUrl":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","sourceDate":"2025-01-08"}],"evidence":[{"title":"Keep the external and internal ICT reports","detail":"Mandiant published successful vs unsuccessful (limited steps) examples. CISA step 1 is run external ICT.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"}]},{"title":"Syslog volume and debug/application logs from mid-December 2024","detail":"Mandiant: exploit script disables SELinux, iptables-drops syslog 514/6514, remounts rw, then sed-scrubs debuglog and log.events.vc0 (segfault, SystemError, ifttls, AUT24604, SYS31048, SYS31376, ERR10073) and audit.log. Sudden silence from a previously logging appliance is investigative. CERT-EU: search for /dana-cached/hc/hc_launcher. version JARs as pre-exploit recon (log review only).","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"},{"url":"https://cert.europa.eu/publications/security-advisories/2025-001","date":"2025-01-08","publisher":"CERT-EU"}]},{"title":"Filesystem snapshot before factory reset","detail":"Preserve /tmp/s, cgi files, DSUpgrade.pm, DSAuth.pm, manifest, libupgrade.so family, /runtime/mtmp/lmdb, and dana-na/css before reset. CISA 2025-04-08 notes RESURGE can undermine earlier mitigations; keep the image.","sources":[{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"},{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-04-08","publisher":"CISA"}]},{"title":"Identity logs behind the VPN","detail":"CISA: monitor authentication or identity management services that could be exposed; continue to audit privileged accounts.","sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-01-08","publisher":"CISA"}]}],"sources":[{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-01-08","publisher":"CISA"},{"url":"https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways","date":"2025-04-08","publisher":"CISA"},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","publisher":"Mandiant"},{"url":"https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerability","date":"2025-01-08","publisher":"NCSC"},{"url":"https://cert.europa.eu/publications/security-advisories/2025-001","date":"2025-01-08","publisher":"CERT-EU"}],"updatedAt":"2026-10-24","addedDate":"2026-10-24"},"bulletins":[{"vendor":"Check Point","title":"CPAI-2025-0002 Ivanti Buffer Overflow (CVE-2025-0282)","url":"https://advisories.checkpoint.com/defense/advisories/public/2025/cpai-2025-0002.html/","date":"2025-01-13","cve":"CVE-2025-0282"},{"vendor":"Cloudflare","title":"Cloudflare WAF release 2025-03-10","url":"https://developers.cloudflare.com/changelog/post/2025-03-10-waf-release/","date":"2025-03-10","cve":"CVE-2025-0282"},{"vendor":"F5","title":"F5 Distributed Cloud attack signatures reference","url":"https://docs.cloud.f5.com/docs-v2/platform/reference/attack-signatures","date":"2025-01-23","cve":"CVE-2025-0282"},{"vendor":"Fortinet","title":"FortiGuard search: CVE-2025-0282","url":"https://www.fortiguard.com/search?q=CVE-2025-0282&engine=1","date":"2025-01-13","cve":"CVE-2025-0282"},{"vendor":"Juniper","title":"HTTP:CTS:IVNTI-CS-RCE","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:IVNTI-CS-RCE.html","date":"2025-01-16","cve":"CVE-2025-0282"},{"vendor":"Juniper","title":"HTTP:CTS:IVNTI-MP-CS-RCE","url":"https://www.juniper.net/us/en/threatlabs/ips-signatures/detail.HTTP:CTS:IVNTI-MP-CS-RCE.html","date":"2025-02-25","cve":"CVE-2025-0282"},{"vendor":"Palo Alto Networks","title":"Threat Brief: Ivanti CVE-2025-0282 and CVE-2025-0283","url":"https://unit42.paloaltonetworks.com/threat-brief-ivanti-cve-2025-0282-cve-2025-0283/","date":"2025-01-16","cve":"CVE-2025-0282"},{"vendor":"Sophos","title":"Sophos IPS signature update 18.22.92","url":"https://docs.sophos.com/releasenotes/output/en-us/nsg/IPSReleaseNotes/18.22.92.html","date":"2025-01-22","cve":"CVE-2025-0282"},{"vendor":"Trend Micro","title":"Digital Vaccine #9992","url":"https://success.trendmicro.com/en-US/solution/KA-0018976","date":"2025-02-04","cve":"CVE-2025-0282","dateKind":"checked"}],"coverage":[{"title":"Security Update: Ivanti Connect Secure, Policy Secure and Neurons for ZTA Gateways","publisher":"Ivanti","url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","date":"2025-01-08","type":"vendor"},{"title":"Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation","publisher":"Mandiant","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","date":"2025-01-08","type":"research"},{"title":"CISA Mitigation Instructions for CVE-2025-0282","publisher":"CISA","url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","date":"2025-01-08","type":"government"},{"title":"Exploitation Walkthrough and Techniques - Ivanti Connect Secure RCE","publisher":"watchTowr","url":"https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","date":"2025-01-12","type":"research"}],"posts":[],"research":[{"title":"Ivanti security update blog","url":"https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways","authors":"Ivanti","date":"2025-01-08"},{"title":"Mandiant UNC5221 analysis","url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","authors":"Mandiant","date":"2025-01-08"},{"title":"NVD CVE-2025-0282","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","authors":"NVD","date":"2025-01-08"},{"title":"CISA mitigation instructions","url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","authors":"CISA","date":"2025-01-08"},{"title":"watchTowr exploitation walkthrough","url":"https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","authors":"Sina Kheirkhah","date":"2025-01-12"}],"impact":{"kind":"single-product","product":"Ivanti Connect Secure / Policy Secure / Neurons for ZTA gateways","versions":[{"version":"Ivanti Connect Secure < 22.7R2.5","status":"affected","versions":"22.7R2.5","vendorStatement":{"date":"2025-01-08","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","quote":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5 ... allows a remote unauthenticated attacker to achieve remote code execution."}},{"version":"Ivanti Policy Secure < 22.7R1.2","status":"affected","versions":"22.7R1.2","vendorStatement":{"date":"2025-01-08","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","quote":"Ivanti Policy Secure before version 22.7R1.2 ... allows a remote unauthenticated attacker to achieve remote code execution."}},{"version":"Ivanti Neurons for ZTA gateways < 22.7R2.3","status":"affected","versions":"22.7R2.3","vendorStatement":{"date":"2025-01-08","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282","quote":"Ivanti Neurons for ZTA gateways before version 22.7R2.3 ... allows a remote unauthenticated attacker to achieve remote code execution."}}]},"pocs":[{"title":"sfewer-r7/CVE-2025-0282","url":"https://github.com/sfewer-r7/CVE-2025-0282","source":"Stephen Fewer (Rapid7)","validationStatus":"validated","validationDate":"2025-01-16","notes":"Public PoC repository created 16 Jan 2025. Referenced from NVD. Description: PoC for CVE-2025-0282."}],"_feed":{"page":"https://vuln2shell.com/vulns/ivanti-connect-secure","json":"https://vuln2shell.com/vulns/ivanti-connect-secure.json","iocsCsv":"https://vuln2shell.com/vulns/ivanti-connect-secure/iocs.csv","stix":"https://vuln2shell.com/vulns/ivanti-connect-secure/stix.json"}}