Article
Volt Typhoon advisory AA24-038A: what CISA says
CISA, NSA and FBI advisory AA24-038A: how Volt Typhoon got in via routers, VPNs and firewalls, stayed up to five years, and what defenders…
Read more
Exploited vulnerability
Ivanti Connect Secure stack overflow (CVE-2025-0282)
CVE-2025-0282
CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and Neurons for ZTA gateways.
- On CISA KEV
- CVE ID
- CVE-2025-0282
- CISA KEV
- Listed
- Affected product
- Connect Secure, Policy Secure and Neurons for ZTA gateways
- Exploited
- Yes
- Published
- January 2025
In short
CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and Neurons for ZTA gateways. The US National Vulnerability Database says a remote attacker with no login can use it to run code on the device. CISA added it to its list of exploited vulnerabilities on 8 January 2025.
- CVECVE-2025-0282
- ProductIvanti Connect Secure, Policy Secure and Neurons for ZTA gateways
- CISA KEVListedKnown Exploited Vulnerabilities
- ExploitedYesin real attacks
- Fix Steps5actions listedPatch to the fixed versions · Hunt beyond the device
What it allows
A remote attacker who does not need a username or password can achieve remote code execution. That means the attacker can run their own commands on the VPN or access gateway, which sits at the edge of the network and often holds credentials and connections to internal systems.
Who is affected
Per the National Vulnerability Database, Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 are affected. The entry lists Connect Secure 22.7R2 to 22.7R2.4 and Policy Secure 22.7R1 to 22.7R1.2 as affected configurations.
CISA added CVE-2025-0282 to its Known Exploited Vulnerabilities catalog on 8 January 2025, the same day the National Vulnerability Database published the entry. CISA's catalog gave a due date of 15 January 2025 for US federal agencies to apply its mitigations.
The catalog marks known ransomware campaign use as Known. CISA's mitigation page says it was updated on 28 March 2025 after a new malware variant called RESURGE was identified that could weaken the earlier mitigations.
What to do
-
Patch to the fixed versions
Update Connect Secure to 22.7R2.5 or later, Policy Secure to 22.7R1.2 or later, and Neurons for ZTA gateways to 22.7R2.3 or later, as the National Vulnerability Database entry states.
-
Run the integrity checker first
CISA tells owners to run Ivanti's external Integrity Checker Tool and to hunt for compromise before returning a device to service.
-
Hunt beyond the device
CISA asks teams to hunt on systems that are connected, or were recently connected, to the affected Ivanti device.
-
Reset if clean, report if not
If no compromise is found, CISA recommends a factory reset for the highest confidence. If a compromise is found, report to CISA and Ivanti immediately to start forensic investigation.
-
Watch identity services
CISA advises monitoring authentication and identity services that could be exposed, and auditing accounts with high privilege.
Questions
What is CVE-2025-0282?
CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure, Policy Secure and Neurons for ZTA gateways. A remote attacker with no username or password can use it to run code on the device.
Which Ivanti versions are affected by CVE-2025-0282?
Per NVD, Connect Secure before 22.7R2.5, Policy Secure before 22.7R1.2, and Neurons for ZTA gateways before 22.7R2.3 are affected. The entry lists Connect Secure 22.7R2 to 22.7R2.4 and Policy Secure 22.7R1 to 22.7R1.2 as affected configurations.
Is CVE-2025-0282 exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 8 January 2025, and the entry flags known ransomware campaign use. CISA later updated its mitigation page after a new malware variant called RESURGE was identified.
How do I respond to CVE-2025-0282?
Update to the fixed versions, then run Ivanti's external Integrity Checker Tool and hunt for compromise, including on connected systems. If nothing is found, CISA recommends a factory reset. If a compromise is found, report it to CISA and Ivanti.
In our research
Sources
- NVD entry CVE-2025-0282 NIST National Vulnerability Database
- Known Exploited Vulnerabilities catalog CISA
- CISA Mitigation Instructions for CVE-2025-0282 CISA
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.