Ivanti Patches Two Actively Exploited Vulnerabilities in VPN Appliances
Summary
Ivanti confirmed active exploitation of CVE-2025-0282, an unauthenticated remote-code-execution flaw in Connect Secure appliances, and CVE-2025-0283. Ivanti recommends upgrading; Mandiant observed exploitation since December 2024.
Key points
- Mandiant observed exploitation of CVE-2025-0282 since December 2024; the stack-based buffer overflow allows unauthenticated remote code execution.
- CVE-2025-0282 affects specified versions of Ivanti Connect Secure, Policy Secure, and Neurons for ZTA Gateways. CVE-2025-0283 also affects these product lines; the article says its exact nature was not disclosed.
- Reported post-exploitation activity includes deploying web shells and other malware, reconnaissance, tunneling, credential and session-data theft, and attempts to evade detection.
- Mandiant linked some activity to China-nexus group UNC5337; other activity involved unidentified actors and malware families including DRYHOOK and PHASEJAM.
- Ivanti recommends upgrading to the latest versions. For suspected compromise, it advises using its Integrity Checker Tool and contacting support; scans may miss threats if an appliance was restored to a clean state.
- For appliances with detected compromise, Ivanti recommends a factory reset and reinstalling with version 22.7R2.5.
Article Details
- Vulnerability Types
- Unauthenticated stack-based buffer overflow
- Severity
- Critical
- Affected Versions
- Ivanti Connect Secure 22.7R2 through 22.7R2.4
- Ivanti Policy Secure 22.7R1 through 22.7R1.2
- Ivanti Neurons for ZTA Gateways 22.7R2 through 22.7R2.3
- Ivanti Connect Secure 22.7R2.4 and prior
- Ivanti Connect Secure 9.1R18.9 and prior
- Ivanti Policy Secure 22.7R1.2 and prior
- Ivanti Neurons for ZTA Gateways 22.7R2.3 and prior
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Upgrade affected appliances to the latest versions; for compromised appliances, Ivanti recommends a factory reset and reinstallation using version 22.7R2.5.
MITRE ATT&CK
T1046 · Network Service DiscoveryAfter exploitation, attackers used nmap and dig for internal reconnaissance.T1070.004 · File DeletionAttackers cleared logs to evade detection.T1078 · Valid AccountsAttackers abused LDAP service accounts for lateral movement.T1090 · ProxyAttackers tunneled traffic through compromised Ivanti appliances.T1190 · Exploit Public-Facing ApplicationAttackers exploited CVE-2025-0282 remotely against Ivanti appliances to achieve unauthenticated code execution.T1505.003 · Web ShellWeb shells were injected into legitimate Ivanti Connect Secure components for persistence and remote access.T1560.001 · Archive via UtilitySensitive data was archived while attackers staged the appliance database cache for exfiltration.T1562.001 · Disable or Modify ToolsAttackers disabled SELinux while preparing compromised appliances for malware deployment.
CVE
CVE-2025-0282Ivanti · Connect Secure; Ivanti · Neurons for ZTA gateways; +1 moreIvanti has confirmed active exploitation of two vulnerabilities, CVE-2025-0282 and CVE-2025-0283, in Ivanti Connect Secure (ICS) VPN appliances.CVE-2025-0283Ivanti · Connect Secure; Ivanti · Neurons for ZTA gateways; +1 moreIvanti has confirmed active exploitation of two vulnerabilities, CVE-2025-0282 and CVE-2025-0283, in Ivanti Connect Secure (ICS) VPN appliances.
Threat Actors
Malware
DRYHOOKa China-nexus cluster, while others involve unidentified actors using unique malware families termed DRYHOOK and PHASEJAM, suggesting multiple threat actors are exploiting these vulnerabilities. PHASEJAMcluster, while others involve unidentified actors using unique malware families termed DRYHOOK and PHASEJAM, suggesting multiple threat actors are exploiting these vulnerabilities. SpawnantSPAWNANT /root/lib/libupgrade.so InstallerSPAWNMOLESPAWNMOLE /root/home/lib/libsocks5.so TunnelerSPAWNSLOTHSPAWNSLOTH /tmp/.liblogblock.so Log tampering utilitySPAWNSNAILSPAWNSNAIL /root/home/lib/libsshd.so SSH backdoor
Vendors
Products
Tools
digactivities include tunneling traffic through the compromised appliance, using tools like nmap and dig for internal reconnaissance, and abusing LDAP service accounts for lateral movement. Sensitive data, suchIntegrity Checker Toolattackers clear logs, modify system files, and recalculate integrity hashes to bypass Ivanti's Integrity Checker Tool (ICT). Nmappost-exploitation activities include tunneling traffic through the compromised appliance, using tools like nmap and dig for internal reconnaissance, and abusing LDAP service accounts for lateral movement. Sensitive