CVE-2025-0282
Published: 08 January 2025
Summary
CVE-2025-0282 is a critical-severity Stack-based Buffer Overflow (CWE-121) vulnerability in Ivanti Connect Secure. Its CVSS base score is 9.0 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of software flaws such as this stack-based buffer overflow through vendor patches.
Implements memory protection mechanisms like stack canaries, ASLR, and DEP to block exploitation of stack-based buffer overflows leading to RCE.
Mandates validation of information inputs for length and format to mitigate buffer overflows from crafted unauthenticated remote payloads.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct remote unauthenticated RCE on public-facing Ivanti VPN/gateway appliance maps to exploitation of public-facing application.
NVD Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
Deeper analysisAI
CVE-2025-0282 is a stack-based buffer overflow vulnerability, associated with CWE-121 and CWE-787, affecting Ivanti Connect Secure versions before 22.7R2.5, Ivanti Policy Secure before 22.7R1.2, and Ivanti Neurons for ZTA gateways before 22.7R2.3. Published on January 8, 2025, it carries a CVSS v3.1 base score of 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H), indicating critical severity with network accessibility, high attack complexity, no privileges or user interaction required, and high impact across confidentiality, integrity, and availability with a changed scope.
A remote unauthenticated attacker can exploit this vulnerability to achieve remote code execution on affected systems. The high attack complexity suggests it requires specific conditions or crafted payloads, but successful exploitation grants full control over the targeted gateway or VPN appliance.
Ivanti's security advisory details patches in Connect Secure 22.7R2.5, Policy Secure 22.7R1.2, and Neurons for ZTA gateways 22.7R2.3, urging immediate upgrades. CISA provides mitigation instructions, while additional resources include exploitation walkthroughs and a GitHub proof-of-concept.
References to this CVE as a zero-day in threat intelligence, alongside public PoCs and detailed exploit techniques, highlight active research and potential for real-world abuse targeting Ivanti VPN and gateway deployments.
Details
- CWE(s)
- KEV Date Added
- 08 January 2025