A stack-based buffer overflow in Ivanti Connect Secure before version 22

CVE-2025-0282 is a stack-based buffer overflow (CWE-121) in the IF-T/TLS handler of Ivanti Connect Secure (<22.7R2.5), Policy Secure (<22.7R1.2), and Neurons for ZTA gateways (<22.7R2.3). The flaw is reachable pre-authentication over TCP/443 on the public-facing VPN endpoint, and exploitation yields code execution as root in the web services context, from which the attacker pivots to disable integrity checks, deploy the SPAWN/DRYHOOK/PHASEJAM toolkits, and persist across upgrades.

Vendor severity (CRITICAL / 9.0) is honest but if anything understated. The CVSS vector marks Attack Complexity as High because the original exploit needed a heap-grooming step, but Mandiant and watchTowr have since published reliable single-shot chains. Combined with active mass exploitation by UNC5337/UNC5221 since December 2024 and CISA KEV listing on the day of disclosure, real-world severity is a flat 9.8.

Why this verdict

• KEV + active mass exploitation: zero friction on intent; nation-state and commodity actors are both burning this bug now.
• Role multiplier — network edge IdP-adjacent appliance: ICS terminates VPN, binds to AD/LDAP, and stores SAML signing material. By definition >90% of installs occupy a high-value role. Floor is CRITICAL.
• Pre-auth, network-reachable, no UI: the entire vector is the appliance doing its job — there is no friction to add.
• Persistence survives patching: SPAWNANT reinjects across the 22.7R2.5 upgrade. Patch alone does not remediate a compromised box.
• EPSS 0.99971: top-of-distribution — every CVE prioritization model agrees.

Why not higher?

9.8 is the practical ceiling for a remote pre-auth RCE on a perimeter appliance with public exploits and KEV listing. There is no higher bucket than CRITICAL in this schema.

Why not lower?

Any downgrade would require either (a) the chain failing in the canonical deployment role or (b) <1% installed-base exposure. Neither holds: ICS exists to be internet-facing, and exploitation is observed at scale. Friction arguments (AC:H, grooming) are obliterated by public single-shot PoCs.

1. Take the ICS web interface offline from the public internet immediately — If you cannot apply 22.7R2.5 today, geo-restrict or fully firewall TCP/443 at the upstream edge until you can. Per noisgate mitigation SLA for CRITICAL + KEV: within hours, not 3 days.
2. Run the external Integrity Checker Tool (ICT) from Ivanti's portal and treat any failure as confirmed compromise — The on-box ICT is the documented bypass target. The external/offline ICT (downloaded fresh from Ivanti support) is the only trustworthy verdict. Run it today; if it flags, move to factory-reset path.
3. Rotate every secret the appliance touches — AD service account passwords, RADIUS shared secrets, SAML signing keys, API tokens, and all active VPN session cookies. Assume credential exfiltration occurred. Within 3 days of patch / rebuild.
4. Factory reset and rebuild from clean media, then patch to 22.7R2.5 — Ivanti's own guidance: in-place patching does NOT evict SPAWNANT. Wipe, reimage 22.7R2.5, restore configuration from a pre-December backup, rotate as above.
5. Hunt for UNC5221 IOCs on the internal network — Mandiant published infrastructure, file hashes, and TTPs. Pivot from the appliance IP in egress logs (Dec 2024 onward) and search for DSLOG/DSREGISTRY artifacts on Windows hosts the gateway could reach.

Run this from an auditor workstation with network reach to the ICS management or external interface — example: ./check-ivanti.sh vpn.example.com. No credentials required; it fingerprints the appliance build banner. For authoritative verdict, follow up with Ivanti's offline ICT on the appliance itself (requires root console / support bundle access).

#!/usr/bin/env bash
# noisgate verification: CVE-2025-0282 (Ivanti Connect Secure pre-auth RCE)
# Usage: ./check-ivanti.sh <hostname-or-ip>
# Exits 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN
set -u
TARGET="${1:-}"
if [ -z "$TARGET" ]; then
  echo "UNKNOWN: usage: $0 <host>" >&2
  exit 2
fi

# Pull the login page and extract the build banner
BANNER=$(curl -sk --max-time 10 "https://${TARGET}/dana-na/auth/url_default/welcome.cgi" \
  | grep -oE 'Version[^<]*[0-9]+\.[0-9]+R[0-9]+(\.[0-9]+)?' | head -1)

if [ -z "$BANNER" ]; then
  # Fall back to TLS cert / health endpoint
  BANNER=$(curl -sk --max-time 10 "https://${TARGET}/" -I | grep -i 'server' | head -1)
fi

if [ -z "$BANNER" ]; then
  echo "UNKNOWN: could not fingerprint ${TARGET} — confirm it is an ICS/IPS appliance"
  exit 2
fi

echo "Detected banner: $BANNER"

# Extract version components (e.g. 22.7R2.4 -> 22 7 2 4)
VER=$(echo "$BANNER" | grep -oE '[0-9]+\.[0-9]+R[0-9]+(\.[0-9]+)?' | head -1)
MAJ=$(echo "$VER" | cut -d. -f1)
MIN=$(echo "$VER" | cut -d. -f2 | cut -dR -f1)
RMAJ=$(echo "$VER" | sed -E 's/.*R([0-9]+).*/\1/')
RMIN=$(echo "$VER" | grep -oE 'R[0-9]+\.[0-9]+' | cut -d. -f2)
RMIN=${RMIN:-0}

# Fixed: ICS 22.7R2.5 and later
if [ "$MAJ" -gt 22 ] 2>/dev/null; then
  echo "PATCHED: $VER >= 22.7R2.5"; exit 0
fi
if [ "$MAJ" -eq 22 ] && [ "$MIN" -eq 7 ]; then
  if [ "$RMAJ" -ge 3 ] || { [ "$RMAJ" -eq 2 ] && [ "$RMIN" -ge 5 ]; }; then
    echo "PATCHED: $VER >= 22.7R2.5"; exit 0
  fi
fi

echo "VULNERABLE: $VER is at or below 22.7R2.4 — patch to 22.7R2.5 and run Ivanti external ICT before trusting the box"
exit 1

Sources

1. Ivanti Security Advisory ICS / IPS / Neurons ZTA
2. CISA KEV entry
3. Mandiant: UNC5337 exploiting CVE-2025-0282
4. watchTowr Labs technical analysis
5. NVD CVE-2025-0282
6. CISA Alert AA25-008A
7. Censys exposure report
8. FIRST EPSS lookup