Ivanti Connect Secure Stack Buffer Overflow (CVE-2025-0282)

CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure and Policy Secure gateways. Unauthenticated remote attackers can crash the service or achieve remote code execution on the VPN appliance.

Affected products

• Ivanti Connect Secure before 22.7R2.5
• Ivanti Policy Secure before 22.7R1.2
• Internet-exposed ICSA/ICSP appliances

Check build

show version
get product version

Remediation

• Apply Ivanti security patch from official advisory immediately
• Use Ivanti external ICT if internal patching is delayed
• Restrict VPN portal to trusted IP ranges at firewall
• Review appliance for web shells and rogue local users after patch

CISA added this to KEV. Mass scanning of /dana-na/ paths is ongoing.