Ivanti Connect Secure - RCE (CVE-2025-22457)
Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
psychologyCrowdSec Analysis
CVE-2025-22457 is a critical stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA Gateways, allowing remote unauthenticated attackers to execute arbitrary code on affected systems. This flaw could be exploited to gain full control over the targeted devices, potentially leading to data breaches, system compromise, or further attacks within the network.
CrowdSec has been tracking this vulnerability and its exploits since 3rd of September 2025.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2025-22457 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. CrowdSec network telemetry also shows that exploitation of CVE-2025-22457 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.
Attackers exploit this vulnerability by sending specially crafted HTTP requests with an oversized X-Forwarded-For header to the /dana-na/auth/url_default/welcome.cgi endpoint, aiming to trigger a stack-based buffer overflow and achieve remote code execution.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-04-03 |
| CISA KEV | 2025-04-04 |
| CISA Remediation Deadline | 2025-04-11 |
| Rule Released | 2025-09-03 |
| CrowdSec First Seen | 2025-09-03 |
Related Weaknesses
A stack-based buffer overflow condition is a condition where the buffer being overwritten is allocated on the stack (i.e., is a local variable or, rarely, a parameter to a function).
The product writes data past the end, or before the beginning, of the intended buffer.