CVE-2025-0282: Ivanti Connect Secure Stack-Based Buffer Overflow RCE

CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and Neurons for ZTA Gateways that lets a remote, unauthenticated attacker execute arbitrary code on the appliance, and it was actively exploited as a zero-day against Connect Secure VPNs beginning in mid-December 2024, weeks before Ivanti's January 2025 patch.

CVE-2025-0282 is a stack-based buffer overflow (CWE-121, with NVD's own primary weakness classification recorded as CWE-787, "Out-of-bounds Write") affecting Ivanti Connect Secure before 22.7R2.5, Ivanti Policy Secure before 22.7R1.2, and Ivanti Neurons for ZTA gateways before 22.7R2.3. A remote attacker with no credentials can trigger the overflow to achieve remote code execution on the appliance (NVD).

NVD has published its own Primary CVSS v3.1 score of 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H — network attack vector, high attack complexity, no privileges or user interaction required, scope changed, with high impact to confidentiality, integrity and availability. This Primary NVD score matches the Secondary score separately submitted by the CNA (source ID 3c1d8aa1-5a33-4ea4-8992-aadd6440af75), so the 9.0 rating is independently confirmed by NVD itself, not just vendor-reported (NVD).

CISA added CVE-2025-0282 to the Known Exploited Vulnerabilities (KEV) catalog on 2025-01-08, the same day as public disclosure, with a required-action due date of 2025-01-15 — an unusually short one-week window reflecting active, in-the-wild exploitation at the time of disclosure. The KEV entry records known use in ransomware campaigns (knownRansomwareCampaignUse: Known) (CISA KEV).

Mandiant (Google Cloud Threat Intelligence), working with Ivanti, reported that exploitation began as a zero-day in mid-December 2024 — before any patch existed — and attributed the campaign to UNC5221, a suspected China-nexus espionage actor with a history of exploiting prior Ivanti Connect Secure vulnerabilities (CVE-2023-46805 and CVE-2024-21887). Mandiant documented a custom malware ecosystem deployed post-exploitation, including the SPAWN family (SPAWNANT, SPAWNMOLE, SPAWNSNAIL, SPAWNSLOTH), a bash dropper tracked as PHASEJAM, a Python credential-theft tool called DRYHOOK, and web shells injected into the getComponent.cgi and restAuth.cgi endpoints (Mandiant/Google Cloud Threat Intelligence).

CISA's mitigation instructions for this CVE direct administrators to run an external Ivanti Integrity Checker Tool (ICT) before deciding on remediation: if no compromise is found, apply the vendor patch and continue monitoring; if compromise indicators are found, disconnect the affected appliance and perform a factory reset using a known-clean image (CISA notes this guidance was updated March 28, 2025, alongside analysis of a related malware family tracked as RESURGE) (CISA Mitigation Instructions for CVE-2025-0282).

As of 2026-10-30, FIRST scores the probability of exploitation at 0.9998 (99.98th percentile), among the highest EPSS scores possible, consistent with a vulnerability that saw mass scanning and exploitation within days of disclosure and remains a priority target (FIRST EPSS).

Ivanti's own security advisory (published via the Ivanti community forums) is referenced directly by both NVD and CISA as the vendor source for affected versions, fixed versions, and the Integrity Checker Tool guidance; the advisory page returns an access-restricted response to automated fetches, so this draft relies on NVD's and CISA's independently confirmed restatement of its version and remediation details rather than quoting vendor text directly (Ivanti Security Advisory (reference only; not independently fetched)).

Any Ivanti Connect Secure, Policy Secure, or Neurons for ZTA Gateway instance on an affected build should be treated as a high-priority target: run the Integrity Checker Tool, patch immediately, and assume compromise unless proven otherwise given the documented pre-patch zero-day exploitation and ransomware use.

• Stack-based buffer overflow in Ivanti Connect Secure before 22.7R2.5, Policy Secure before 22.7R1.2, and Neurons for ZTA gateways before 22.7R2.3 allows remote unauthenticated code execution. — NVD
• CVSS v3.1 base score 9.0 (critical), vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, published by NVD as a Primary ([email protected]) metric matching the CNA's Secondary submission. — NVD
• Added to the CISA Known Exploited Vulnerabilities catalog on 2025-01-08, due date 2025-01-15, with known ransomware campaign use. — CISA KEV
• Exploited as a zero-day beginning mid-December 2024, attributed to UNC5221 (suspected China-nexus espionage actor), with a custom post-exploitation malware ecosystem (SPAWN family, PHASEJAM, DRYHOOK) and web shells in getComponent.cgi and restAuth.cgi. — Mandiant / Google Cloud Threat Intelligence
• CISA mitigation guidance requires running the Ivanti Integrity Checker Tool before deciding between patch-and-monitor or disconnect-and-factory-reset remediation paths; guidance updated March 28, 2025. — CISA Mitigation Instructions
• EPSS score is 0.9998 (99.98th percentile) as of 2026-10-30. — FIRST EPSS