CVE-2025-0282

Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Reserved 2025-01-06 | Published 2025-01-08 | Updated 2025-01-09 | Assigner ivanti

CISA Known Exploited Vulnerability

Date added 2025-01-08 | Due date 2025-01-15

Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.

Problem types

CWE-121: Stack-based Buffer Overflow

Product status

Default status
unaffected

22.7R2
affected

22.7R2.5
unaffected

Default status
unaffected

22.7R1
affected

Default status
unaffected

22.7R2
affected

22.7R2.5
unaffected

References

forums.ivanti.com/...TA-Gateways-CVE-2025-0282-CVE-2025-0283

cve.org (CVE-2025-0282)

nvd.nist.gov (CVE-2025-0282)

Download JSON