CVE-2025-0282

CVE Enrichment

CVSS: 9.0 CRITICAL
EPSS: 99.98%
EPSS Percentile: 99.98%
CISA KEV: YES — Known Exploited Vulnerability

Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Technical Details

CVSS Version: 3.1
CNA / NVD Source: 3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Published: 09-Jan-2025 06:15
Last Modified: 02-Oct-2026 02:17
EPSS Date: 2026-10-12
CWE: CWE-121, CWE-787

CVSS Vector


            CVSS:3.1                            AV:N /
                            AC:H /
                            PR:N /
                            UI:N /
                            S:C /
                            C:H /
                            I:H /
                            A:H

CISA KEV Details

Date Added: 2025-01-08
Remediation Due: 2025-01-15
Known Ransomware Campaign Use: Known
Required Action: Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
Notes: CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282 Additional References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0282

Affected Products / Versions

ivanti / connect_secure
Version / affected range: 22.7
cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.7
cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.7
cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.7
cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*
ivanti / connect_secure
Version / affected range: 22.7
cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*
ivanti / neurons_for_zero-trust_access
Version / affected range: 22.7
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2:*:*:*:*:*:*
ivanti / neurons_for_zero-trust_access
Version / affected range: 22.7
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2.2:*:*:*:*:*:*
ivanti / neurons_for_zero-trust_access
Version / affected range: 22.7
cpe:2.3:a:ivanti:neurons_for_zero-trust_access:22.7:r2.3:*:*:*:*:*:*
ivanti / policy_secure
Version / affected range: 22.7
cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*
ivanti / policy_secure
Version / affected range: 22.7
cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*
ivanti / policy_secure
Version / affected range: 22.7
cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*

References

Last enrichment sync: 13-Oct-2026 00:45
Sources: NVD · FIRST EPSS · CISA KEV
Latest successful provider update; providers refresh independently.

Reported Context (1)

Fortinet CVE-2022-42475, CVE-2023-27997 and CVE-2024-21762; Ivanti CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282; Zerologon CVE-2020-1472; EternalBlue MS17-010; SMBGhost CVE-2020-0796. CloudSEK Details MexicanMafia-Linked Intrusion Campaign Targeting Latin American Organizations

CVE (12)

People (4)

Threat Actors (7)

MITRE ATT&CK (68)

Vendors (7)

Products (14)

Tools (35)

Industries (7)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.