CVE-2025-22454 | THREATINT

Description

Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.

Reserved 2025-01-07 | Published 2025-03-11 | Updated 2025-03-12 | Assigner ivanti

HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-732 Incorrect Permission Assignment for Critical Resource

Product status

Default status

affected

22.7R4

unaffected

22.8R1

unaffected

References

forums.ivanti.com/...ecure-Access-Client-ISAC-CVE-2025-22454

cve.org (CVE-2025-22454)

nvd.nist.gov (CVE-2025-22454)

Download JSON