CVE-2025-0282 · Ivanti Connect Secure / Policy Secure / ZTA Gateways Pre-Auth Stack…

01 · The Real Story

The front door to your network has a skeleton key slot that Chinese intelligence has been using since before anyone noticed

CVE-2025-0282 is a stack-based buffer overflow in the /home/bin/web binary of Ivanti Connect Secure (before 22.7R2.5), Ivanti Policy Secure (before 22.7R1.2), and Ivanti Neurons for ZTA gateways (before 22.7R2.3). The flaw lives in the IF-T/TLS protocol handler — the code that processes VPN tunnel setup requests. The developers passed the *source* string length to strncpy instead of the *destination* buffer size (256 bytes), so any unauthenticated client sending an oversized clientCapabilities value overflows the stack. The attacker hijacks a C++ this pointer on the stack to redirect a virtual function call through a fake vtable, pivots the stack, and chains ROP gadgets into arbitrary command execution — all before any authentication check. ASLR is present but x86 partial randomization makes brute-forcing feasible in roughly 34 minutes. There are no stack canaries.

Ivanti rated this CVSS 9.0 CRITICAL with AC:H (high attack complexity), ostensibly because of the ASLR brute-force requirement. That label *under-sells* the real-world severity. China-nexus group UNC5337 had already weaponized this as a zero-day weeks before disclosure in mid-December 2024, deploying the SPAWN malware ecosystem (SPAWNANT installer, SPAWNMOLE tunneler, SPAWNSNAIL SSH backdoor), DRYHOOK credential-harvester, and PHASEJAM — a persistence implant that fakes Ivanti upgrade progress bars to block legitimate patching. In March 2025, CISA published analysis of RESURGE, an even more advanced implant that achieves boot-level persistence by modifying coreboot firmware images, deploys web shells into legitimate Ivanti CGI files, and recalculates integrity-checker hashes to evade Ivanti's own ICT. When the theoretical 'high complexity' barrier has been defeated by multiple nation-state operators, multiple public PoCs, and a Rapid7-authored exploit module — the complexity is no longer high. This is a textbook CRITICAL that the vendor scored one notch too conservatively.

"Actively exploited pre-auth RCE on internet-facing VPN gateway. Nation-state zero-day. Patch now."

02 · The Attack Path

6 steps from start to impact.

STEP 01

Identify exposed Ivanti appliance

The attacker scans the internet for Ivanti Connect Secure login portals, which are accessible on port 443 by design. Shodan, Censys, and FOFA all index these appliances. Censys identified ~33,542 exposed instances globally as of January 2025, with ~12,335 running vulnerable versions. Version fingerprinting is trivial via unauthenticated HTTP requests to known Ivanti endpoints.

Conditions required:

Internet access
Target runs ICS < 22.7R2.5, Policy Secure < 22.7R1.2, or ZTA < 22.7R2.3

Where this breaks in practice:

None — ICS appliances are internet-facing by architectural design

Detection/coverage: Censys, Shodan, FOFA, Qualys External Attack Surface Management, and Bitsight all enumerate Ivanti appliances. GreyNoise detected a 100× surge in reconnaissance traffic targeting these endpoints.

STEP 02

Send malicious IF-T/TLS handshake

The attacker opens a TLS connection to the IFT protocol handler and sends a crafted clientCapabilities attribute exceeding 256 bytes. The strncpy call in /home/bin/web copies the entire source string into the undersized stack buffer, overwriting the C++ this pointer and adjacent stack variables. No authentication is required — the overflow occurs during the protocol negotiation phase, before any credential check.

Conditions required:

Network reachability to port 443 on the target

Where this breaks in practice:

None — this is pre-authentication, no credentials or session needed

Detection/coverage: IDS signatures from Snort/Suricata (e.g., ET rules for malformed IF-T handshakes), Ivanti ICT (internal/external), Palo Alto Unit 42 threat signatures.

STEP 03

Hijack vtable and pivot stack via ROP

Rather than overwriting the return address directly (which would crash on a destructor free() call first), the attacker overwrites the this pointer to point to a fake vtable structure. When the code dereferences *(*(DWORD *)a1 + 0x48), it calls the attacker's chosen gadget. The first gadget performs a stack pivot (add esp, 0x204C; ret) redirecting execution into attacker-controlled buffer space. From there, a ROP chain calls system() with an arbitrary command. ASLR brute-forcing is required but feasible on x86 in ~34 minutes due to limited entropy. Tools: watchTowr PoC, sfewer-r7 PoC, absholi7ly exploit.

Conditions required:

Successful buffer overflow from step 2
x86 target (partial ASLR)

Where this breaks in practice:

ASLR brute-force takes ~34 minutes — but nation-state actors and multiple public PoCs have operationalized this

Detection/coverage: Crash logs on the appliance during brute-force attempts; Ivanti ICT may detect binary anomalies; EDR is not typically deployed on appliance OS.

STEP 04

Deploy persistence malware

Post-exploitation, the attacker disables SELinux, remounts the filesystem read-write, and deploys malware. Observed payloads include SPAWNANT (installer that hijacks the dspkginstall upgrade binary for persistence across patches), SPAWNMOLE (SOCKS5 tunneler), SPAWNSNAIL (SSH backdoor), PHASEJAM (blocks legitimate upgrades by rendering fake HTML progress bars), DRYHOOK (credential harvester), and RESURGE (boot-level persistence via coreboot firmware modification, web shell in compcheckresult.cgi, integrity-checker hash recalculation).

Conditions required:

Command execution achieved in step 3

Where this breaks in practice:

None — the appliance OS is a stripped Linux environment with no EDR, no third-party AV, and limited logging

Detection/coverage: Ivanti ICT (but RESURGE can defeat it by recalculating manifest hashes); CISA recommends factory reset regardless of ICT results.

STEP 05

Establish network pivot and harvest credentials

The SPAWNMOLE tunneler provides a SOCKS proxy into the internal network. DRYHOOK captures VPN user credentials as they authenticate through the compromised appliance — the attacker now has valid enterprise credentials for lateral movement. The SPAWNSNAIL SSH backdoor provides persistent out-of-band access. RESURGE can forge TLS certificates for covert C2 communications that blend with legitimate Ivanti traffic.

Conditions required:

Persistence established in step 4

Where this breaks in practice:

Network segmentation behind the VPN concentrator may limit blast radius — but the appliance sits at the trust boundary by design, and harvested credentials bypass network controls

Detection/coverage: Network traffic analysis for anomalous SOCKS tunneling, SSH connections from the appliance to unexpected destinations, TLS certificate anomalies, credential-use monitoring (impossible-travel, unusual MFA patterns).

STEP 06

Full enterprise compromise

With valid credentials harvested from the VPN gateway and a SOCKS tunnel into the internal network, the attacker has the equivalent of an authenticated insider position. From Ivanti's position at the network perimeter, the attacker can reach Active Directory, internal applications, cloud gateways, and backup infrastructure. UNC5337/UNC5221 campaigns have been observed conducting multi-stage intrusions including data exfiltration and further implant deployment across victim environments.

Conditions required:

Internal network access + valid credentials from steps 4-5

Where this breaks in practice:

MFA on internal resources (if not bypassed by harvested session tokens)
Network microsegmentation
PAM controls on privileged accounts

Detection/coverage: SIEM correlation of VPN gateway-originated lateral movement, EDR on internal hosts detecting anomalous authentication patterns, identity-based detection (impossible-travel, credential stuffing indicators).

03 · Compensating Control

CRITICAL 9.8→LOW 2.0

SEVERITY REDUCED

Factory-reset and rebuild all Ivanti appliances before patching to 22.7R2.5 — CISA explicitly recommends factory reset regardless of Ivanti ICT results because RESURGE can achieve boot-level persistence by modifying coreboot firmware and recalculating integrity-checker hashes. Simply applying the patch over a compromised appliance may leave RESURGE, SPAWNANT, or PHASEJAM intact. Under the noisgate mitigation SLA for CRITICAL, deploy within 3 days. Export configs, factory-reset, install 22.7R2.5 from clean media, and restore configs manually (do not restore from appliance backup, which may contain implants).

CRITICAL 9.8→CRITICAL 9.0

Force credential rotation for all VPN users immediately — DRYHOOK harvests VPN user credentials as they authenticate through compromised appliances. Any credentials used on a potentially compromised ICS instance since mid-December 2024 should be considered stolen. Reset passwords and revoke/reissue MFA tokens for all users who authenticated via the affected appliance. This does not fix the appliance vulnerability but eliminates the lateral-movement value of harvested credentials. Deploy within 3 days per noisgate mitigation SLA for CRITICAL.

CRITICAL 9.8→LOW 2.5

SEVERITY REDUCED

Block IF-T/TLS protocol at the network edge if not required — If your organization uses only SSL-VPN mode and does not require IF-T/TLS (IPsec) tunnel establishment, blocking the IF-T protocol at an upstream firewall or load balancer eliminates the vulnerable code path entirely. This is a narrow mitigation — verify that your VPN clients do not use IF-T mode before implementing. If feasible, this fully mitigates the pre-auth RCE vector.

CRITICAL 9.8→HIGH 7.5

SEVERITY REDUCED

Deploy network segmentation behind VPN concentrators — Place Ivanti appliances in a DMZ with strict egress filtering. Limit what internal networks the VPN gateway can reach to only necessary destinations. This does not prevent the initial compromise but constrains the SPAWNMOLE tunneler's ability to pivot deep into the enterprise. Residual risk remains HIGH because the appliance still processes all VPN user credentials.

CRITICAL 9.8→CRITICAL 9.0

Monitor for known SPAWN/RESURGE/PHASEJAM IOCs — Deploy YARA rules and network signatures for known SPAWN ecosystem components. Monitor for: SSH connections originating from the ICS appliance to internal hosts, unexpected modifications to compcheckresult.cgi, SELinux disablement events, filesystem remount-rw events, and anomalous TLS certificate generation. CISA's MAR-25993211 provides detailed IOCs. This is detection, not prevention — it does not reduce the exploitability but improves mean-time-to-detect.

What doesn't work

Ivanti Integrity Checker Tool (ICT) alone — RESURGE recalculates and replaces file hashes in the ICT manifest, allowing it to pass integrity checks while the appliance remains compromised. CISA explicitly warns that a clean ICT result does not guarantee the appliance is uncompromised.
Applying the patch without factory reset — SPAWNANT persists across system upgrades by hijacking the dspkginstall binary. PHASEJAM blocks legitimate updates by rendering fake progress bars. A simple upgrade may appear successful while the implant remains active.
WAF in front of the appliance — the vulnerability is in the IF-T/TLS protocol handler, not in HTTP request processing. A WAF inspecting HTTP traffic will not see or block the malicious IF-T handshake that triggers the overflow.
Standard EDR on the appliance — Ivanti Connect Secure runs a hardened, stripped Linux OS that does not support third-party endpoint agents. There is no EDR to catch post-exploitation activity on the appliance itself.

04 · Intelligence Metadata

The supporting signals.

In-the-Wild Exploitation	Confirmed active zero-day exploitation since mid-December 2024, weeks before disclosure on January 8, 2025. Attributed to China-nexus threat actor UNC5337 (assessed part of UNC5221 with medium confidence) by Mandiant/Google. Multiple sophisticated malware families deployed: SPAWN ecosystem, DRYHOOK, PHASEJAM, and RESURGE. CISA published dedicated malware analysis report AR25-087A.
Proof-of-Concept Availability	Multiple weaponized public PoCs: watchtowrlabs/CVE-2025-0282 (full exploitation walkthrough + code), sfewer-r7/CVE-2025-0282 (Rapid7 Ruby PoC with ROP chain targeting 22.7R2.4, demonstrates RCE in ~34 min), absholi7ly/CVE-2025-0282-Ivanti-exploit (Python web shell uploader), almanatra/CVE-2025-0282. Nuclei templates available. Pentest-Tools published combined exploitation guide.
EPSS Score	0.99979 (99.98th percentile) — the EPSS model estimates near-certainty of exploitation activity, which is consistent with confirmed active campaigns.
CISA KEV Status	Listed January 8, 2025 (same day as disclosure). Federal remediation deadline was January 15, 2025 (7 days). CISA SSVC assessment: Active exploitation / No automatable attacks / Total technical impact.
CVSS Vector	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H` — 9.0 CRITICAL. Network-accessible, no privileges, no user interaction, scope-change (attacker pivots from appliance to internal network). AC:H reflects ASLR brute-force requirement, but real-world exploitation demonstrates this is reliably defeated.
Affected Versions	Ivanti Connect Secure < 22.7R2.5, Ivanti Policy Secure < 22.7R1.2, Ivanti Neurons for ZTA gateways < 22.7R2.3. All prior major versions (9.x, 22.x series) are affected if not upgraded to the patched releases.
Fixed Versions	Ivanti Connect Secure 22.7R2.5, Ivanti Policy Secure 22.7R1.2 (patch availability was delayed at initial disclosure), Ivanti Neurons for ZTA 22.7R2.3. CISA recommends factory reset before applying patch regardless of ICT results due to RESURGE boot-level persistence.
Internet Exposure	Censys: ~33,542 ICS instances exposed globally (Jan 2025), with ~12,335 (~37%) running vulnerable versions. Shodan reported up to ~230K instances (likely inflated by honeypots). GreyNoise observed 100× surge in reconnaissance targeting ICS appliances. Bitsight tracks exposure across customer portfolios.
Disclosure Date	January 8, 2025. Zero-day exploitation began mid-December 2024. watchTowr published full exploitation walkthrough and PoC on January 15, 2025. CISA published RESURGE malware analysis on March 28, 2025.
Reporting Researchers	Initial discovery via Ivanti's own monitoring. Mandiant/Google attributed exploitation to UNC5337. watchTowr Labs published the definitive exploitation walkthrough. Spencer Fewer (sfewer-r7, Rapid7) authored the weaponized PoC. CISA performed RESURGE malware analysis.

Sources.

05 · The Call

Final Verdict

= UNCHANGED to CRITICAL (9.8/10)

Why this verdict

Confirmed nation-state zero-day exploitation negates AC:H. The CVSS vector rates attack complexity as HIGH due to ASLR brute-forcing, which is the sole factor keeping the vendor score at 9.0 instead of 10.0. However, UNC5337 operationalized this exploit weeks before disclosure, and Rapid7's PoC demonstrates reliable exploitation in ~34 minutes. When multiple threat actors and public tools defeat the complexity barrier routinely, the real-world AC is effectively LOW. This alone justifies upgrading from 9.0 to 9.8.
Pre-authentication, zero-interaction, internet-facing by design. Unlike most network appliance vulns that require some foothold, this overflow fires during the IF-T/TLS protocol handshake — before any credential check. The target component (VPN gateway) is architecturally required to be internet-facing. There is zero friction between the attacker and the vulnerable code path.
Post-exploitation persistence defeats patching and integrity checking. RESURGE achieves boot-level persistence by modifying coreboot firmware and recalculating Ivanti ICT hashes. PHASEJAM blocks legitimate updates. SPAWNANT survives system upgrades. This means even organizations that patch may remain compromised — CISA explicitly recommends factory reset. The blast radius extends beyond the appliance to the entire enterprise via credential harvesting and network tunneling.
Role multiplier: Ivanti Connect Secure IS the network perimeter. This is not a component that *sometimes* occupies a high-value role — 100% of ICS deployments are internet-facing VPN gateways by definition. The blast radius of compromising a VPN concentrator is: (1) all VPN user credentials via DRYHOOK, (2) full internal network access via SPAWNMOLE tunneling, (3) persistence that survives patching via RESURGE firmware modification. The deployment role is canonically network-edge/perimeter — the verdict floor is CRITICAL per the high-value-role catalog. Confirmed campaigns demonstrate domain-to-fleet-scale compromise outcomes.
Role multiplier: ZTA gateway variant is identity-adjacent. Ivanti Neurons for ZTA gateways serve as zero-trust policy enforcement points — compromising them undermines the entire zero-trust architecture. This places the ZTA variant in the identity/trust high-value role, further reinforcing the CRITICAL floor.

Why not higher?

A 10.0 would require AC:L in the CVSS vector, meaning the exploit works on the first attempt with no brute-forcing. While the ASLR brute-force has been operationalized, it still takes ~34 minutes and generates crash signatures that could theoretically be detected. The x86 partial ASLR is weak but not absent. A 9.8 accurately reflects a near-certain exploitation scenario with a minor, routinely-defeated technical obstacle.

Why not lower?

Every downgrade lever is absent here. The target is internet-facing by architectural requirement (no 'internal only' friction). The exploit is pre-auth (no credential friction). Multiple public PoCs exist (no capability friction). Nation-state actors have been exploiting it for months (no theoretical-only friction). The EPSS is 99.98%. It's KEV-listed. The post-exploitation tooling achieves boot-level persistence that defeats standard remediation. There is no legitimate argument for anything below CRITICAL.

06 · Verification

Crowdsourced verification payload.

Run this script from an auditor workstation (not the Ivanti appliance itself) with network access to the target ICS instance on port 443. Usage: bash check_cve_2025_0282.sh <target_hostname_or_ip>. No special privileges required — it performs an unauthenticated HTTPS version check only.

noisgate-verify.sh

BASHREAD-ONLYSAFE

#!/usr/bin/env bash
# CVE-2025-0282 Version Checker for Ivanti Connect Secure
# Checks if the target is running a vulnerable version
# Exit codes: 0 = PATCHED, 1 = VULNERABLE, 2 = UNKNOWN

set -euo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <target_hostname_or_ip>"
  exit 2
fi

echo "[*] Checking Ivanti Connect Secure version on $TARGET ..."

# Attempt to fetch version info from the login page or known endpoints
RESPONSE=$(curl -sk --max-time 15 "https://${TARGET}/dana-na/auth/url_default/welcome.cgi" 2>/dev/null || true)

if [[ -z "$RESPONSE" ]]; then
  # Try alternate endpoint
  RESPONSE=$(curl -sk --max-time 15 "https://${TARGET}/" 2>/dev/null || true)
fi

if [[ -z "$RESPONSE" ]]; then
  echo "[!] UNKNOWN - Could not connect to $TARGET on port 443"
  exit 2
fi

# Check if this is an Ivanti/Pulse Secure appliance
if ! echo "$RESPONSE" | grep -qiE 'ivanti|pulse.secure|connect.secure|welcome.cgi|dana-na'; then
  echo "[!] UNKNOWN - Target does not appear to be an Ivanti Connect Secure appliance"
  exit 2
fi

echo "[+] Target appears to be an Ivanti Connect Secure appliance"

# Try to extract version from HTTP headers or page content
HEADERS=$(curl -skI --max-time 15 "https://${TARGET}/" 2>/dev/null || true)
VERSION=$(echo "$RESPONSE $HEADERS" | grep -oiE '22\.7[Rr][0-9]+\.[0-9]+' | head -1 || true)

if [[ -z "$VERSION" ]]; then
  # Version not externally enumerable on all builds
  echo "[!] UNKNOWN - Could not determine version remotely."
  echo "    Manual check: SSH to appliance and run 'show version' or check admin UI."
  echo "    Vulnerable: ICS < 22.7R2.5, Policy Secure < 22.7R1.2, ZTA < 22.7R2.3"
  echo "    IMPORTANT: Run Ivanti ICT AND check CISA IOCs regardless."
  echo "    CISA recommends factory reset even if ICT is clean."
  exit 2
fi

echo "[*] Detected version: $VERSION"

# Normalize version for comparison (e.g., 22.7R2.5 -> 22 7 2 5)
parse_version() {
  echo "$1" | sed -E 's/[Rr\.]+/ /g' | awk '{print $1, $2, $3, $4}'
}

read -r MAJ1 MIN1 REL1 PATCH1 <<< $(parse_version "$VERSION")
PATCH1=${PATCH1:-0}

# Patched version for ICS: 22.7R2.5
PATCHED_REL=2
PATCHED_PATCH=5

echo "[*] Comparing against patched version 22.7R2.5 ..."

if [[ "$MAJ1" -eq 22 && "$MIN1" -eq 7 ]]; then
  if [[ "$REL1" -gt "$PATCHED_REL" ]]; then
    echo "[+] PATCHED - Version $VERSION is newer than 22.7R2.5"
    exit 0
  elif [[ "$REL1" -eq "$PATCHED_REL" && "$PATCH1" -ge "$PATCHED_PATCH" ]]; then
    echo "[+] PATCHED - Version $VERSION meets or exceeds 22.7R2.5"
    exit 0
  else
    echo "[!] VULNERABLE - Version $VERSION is below 22.7R2.5"
    echo "    CVE-2025-0282: Pre-auth RCE via stack buffer overflow in IF-T/TLS handler"
    echo "    ACTION: Factory reset + upgrade to 22.7R2.5 immediately"
    echo "    ACTION: Rotate ALL VPN user credentials"
    echo "    ACTION: Run CISA IOC checks for SPAWN/RESURGE/PHASEJAM"
    exit 1
  fi
else
  echo "[!] VULNERABLE - Version $VERSION is an older major release (pre-22.7)"
  echo "    All versions before 22.7R2.5 are affected"
  echo "    ACTION: Factory reset + upgrade to 22.7R2.5 immediately"
  exit 1
fi