CVE-2025-0282

Ivanti · Published January 8, 2025

9.0

CVSS v3.1

CRITICAL

CISA KEV — Federal agencies must patch by deadline

Actively exploited in the wild

Patch availableGet patch

Description

Ivanti Connect Secure, Policy Secure, and ZTA Gateways stack-based buffer overflow allowing unauthenticated remote code execution. Exploited by China-nexus threat actors deploying SPAWN malware family.

Affected Products

Ivanti Connect Secure < 22.7R2.5
Ivanti Policy Secure < 22.7R1.2
Ivanti ZTA Gateway < 22.8R2

CVSS Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

Related Advisories

CVECRITICALCVE-2025-22457

Ivanti Connect Secure Zero-Day (CVE-2025-22457) Exploited by China-Nexus UNC5221

A critical stack-based buffer overflow in Ivanti Connect Secure VPN was exploited as a zero-day by UNC5221 (China-nexus) to deploy TRAILBLAZE dropper and BRUSHFIRE passive backdoor on edge devices globally.

WHY IT MATTERS

If you run Ivanti Connect Secure for remote access, assume compromise until the Integrity Checker Tool clears your appliance.

IvantiVPNRemote Code Execution+3 more

Apr 3, 2025· 5 min read