UpHeron
All vulnerabilities

Servers and applications

CVE-2025-0282

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 8 Jan 2025.

Severity
Critical 9.0
Published
8 Jan 2025
Last changed
1 Oct 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Ivanti Connect SecureServers and applications · cpe:a:ivanti:connect_secure
  • Version 22.7-r2
  • Version 22.7-r2.1
  • Version 22.7-r2.2
  • Version 22.7-r2.3
  • Version 22.7-r2.4

Known exploited

CISA name
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Required action
Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
Due for US agencies
15 Jan 2025
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-0282
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-0282