Connect Secure - RCE (CVE-2025-0282)
Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
psychologyCrowdSec Analysis
CVE-2025-0282 is a critical stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways, allowing remote unauthenticated attackers to execute arbitrary code on affected systems. This flaw could be exploited to gain full control over the targeted devices, potentially leading to data breaches, system compromise, or further attacks within the network.
CrowdSec has been tracking this vulnerability and its exploits since 15th of October 2025.
CrowdSec network data shows that most actors exploiting CVE-2025-0282 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature. In addition, according to the CrowdSec network, attack volume against CVE-2025-0282 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Attackers exploit this vulnerability by sending crafted POST requests to the /dana-na/auth/url_default/welcome.cgi endpoint, often containing large or unusual payloads designed to achieve remote code execution or upload web shells.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-01-08 |
| CISA KEV | 2025-01-08 |
| CISA Remediation Deadline | 2025-01-15 |
| Rule Released | 2025-10-15 |
| CrowdSec First Seen | 2025-10-24 |
Related Weaknesses
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
The product writes data past the end, or before the beginning, of the intended buffer.
Remediation & Protection
External References
- https://github.com/sfewer-r7/CVE-2025-0282
- https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day
- https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/
- https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0282
- https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282
- https://github.com/rix4uni/cvemapping/blob/main/2025/CVE-2025-0282/CVE_2025_0282_Ivanti.py