This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.

[TLP:CLEAR] Ivanti Connect Secure, Policy Secure and Neurons for ZTA gateways fix two vulnerabilities

Ivanti fixes two vulnerabilities in its products, one of which is critical and actively exploited [1]. Fixed product versions and their availability: Ivanti Connect Secure (ICS) - 22.7R2.5, available Ivanti Policy Secure (IPS) - patch availability planned for 21 January 2025 Ivanti Neurons for ZTA gateways - 22.7R2.5, patch availability planned for 21 January 2025 The company recommends regular monitoring of the system using the Integrity Checker Tool (ICT) or other tools. As a precaution, for ICS it is recommended to perform a factory reset before deploying version 22.7R2.5, even if the tool does not detect a problem. If signs of compromise are detected, a factory reset is necessary before deploying version 22.7R2.5. Detailed recommendations for ICS and for products for which patches are not yet available can be found at [1].

Ivanti Connect Secure, Policy Secure, Neurons for ZTA gateways - RCE (CVE-2025-0282)
CVSS 9.0 (Critical)

An unauthenticated remote attacker can execute code due to a stack-based buffer overflow. Ivanti has confirmed active exploitation of this vulnerability on some machines running ICS [1][2]. Its exploitation can be detected using the ICT tool [1]. IoCs of a possible attack can be found at [2].

The vulnerability is present in products:

  • Ivanti Connect Secure; >=22.7R2, <=22.7R2.4;
  • Ivanti Policy Secure; >=22.7R1, <=22.7R1.2;
  • Ivanti Neurons for ZTA gateways; >=22.7R2, <=22.7R2.3;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 8. 1. 2025.

Ivanti Connect Secure, Policy Secure, Neurons for ZTA gateways - privilege escalation (CVE-2025-0283)
CVSS 7.0 (High)

An authenticated local attacker can elevate their privileges due to a stack-based buffer overflow [1].

The vulnerability is present in products:

  • Ivanti Connect Secure; >=9.1R1, <=9.1R18.9; >=22.7R1, <=22.7R2.4;
  • Ivanti Policy Secure; >=22.7R1, <= 22.7R1.2;
  • Ivanti Neurons for ZTA gateways; >=22.7R1, <=22.7R2.3;

CVSS: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 8. 1. 2025.

By CESNET, z.s.p.o. Michaela Ručková on 9. 1. 2025.

CESNET, z.s.p.o. Logo