⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.. Due date: 2025-01-15.
CVE-2025-0282 — Stack-based Buffer Overflow in Ivanti Connect Secure
Severity
9.0CRITICALNVD
EPSS
94.1%
top 0.09%
CISA KEV
KEVRansomware
Added 2025-01-08
Due 2025-01-15
Exploit
PoC available
Public exploit / PoC exists
Timeline
PublishedJan 8
KEV addedJan 8
KEV dueJan 15
Latest updateFeb 27
CISA Required Action: Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 2.2 | Impact: 6.0
Affected Packages6 packages
🔴Vulnerability Details
3💥Exploits & PoCs
2Nuclei▶
Ivanti Connect Secure - Stack-based Buffer Overflow