Cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3aivanticonnect_secure22.7r2.1/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 03 Sep 2026 01:48:00 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgUnauthenticated RCE in Ivanti Connect Secure via CVE-2025-0282https://feed.craftedsignal.io/briefs/2026-09-cve-2025-0282/Thu, 03 Sep 2026 01:48:00 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-09-cve-2025-0282/A critical unauthenticated stack buffer overflow in Ivanti Connect Secure, Policy Secure, and Neurons for Zero-trust Access (version 22.7) allows remote attackers to execute arbitrary code and create unauthorized administrative accounts.CVE-2025-0282 is a critical stack buffer overflow vulnerability impacting multiple Ivanti products, including Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for Zero-trust Access, specifically version 22.7. The vulnerability exists within the unauthenticated interface, allowing remote attackers to trigger the overflow without prior access credentials. Proof-of-concept exploit code is publicly available, utilizing ROP chains to achieve code execution. Research indicates that successful exploitation leads to the creation of a local administrative account with root-level privileges (UID 0), granting the attacker full control over the appliance. Defenders should prioritize patching, as the presence of public exploit scripts significantly increases the risk of targeted exploitation against internet-facing appliances.

Impact

Successful exploitation of CVE-2025-0282 results in complete system compromise. By creating a persistent administrative account, an attacker can maintain long-term access, facilitate lateral movement within the network, and exfiltrate sensitive data managed by the Ivanti gateway. Given the criticality of these appliances as entry points for remote access, the risk to confidentiality, integrity, and availability is high.

Recommendation

  • Immediately identify and patch all internet-facing Ivanti Connect Secure, Policy Secure, and Neurons for Zero-trust Access appliances running version 22.7.
  • Review administrative user account logs for the creation of unexpected accounts or modifications to existing accounts.
  • Restrict access to administrative and management interfaces to trusted internal IP ranges or VPN-only access to reduce the attack surface.
  • Monitor for anomalous outbound network traffic from Ivanti appliances, which may indicate post-exploitation activity or C2 communication.
]]>criticaladvisoryvulnerabilityremote-code-executionivanti