# CVE-2025-22457: Ivanti Connect Secure - RCE

> Live exploitation tracking for CVE-2025-22457 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-22457

## Key facts

- **Exploitation phase:** Background Noise. Continuous low-level scanning or exploitation attempts are observed, mostly opportunistic and automated.
- **CVSS score:** 9.0
- **Public exploit available:** Yes
- **Affected products:** Ivanti Connect Secure, Ivanti Policy Secure, Ivanti Neurons for ZTA gateways
- **Weaknesses:** CWE-121 (Stack-based Buffer Overflow); CWE-787 (Out-of-bounds Write)
- **Tags:** sslvpn, enterprise_software

## Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

## CrowdSec analysis

[CVE-2025-22457](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-22457) is a critical stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and Neurons for ZTA Gateways, allowing remote unauthenticated attackers to execute arbitrary code on affected systems. This flaw could be exploited to gain full control over the targeted devices, potentially leading to data breaches, system compromise, or further attacks within the network.

CrowdSec has been tracking this vulnerability and its exploits since 3rd of September 2025.

CrowdSec network data shows that most actors exploiting CVE-2025-22457 rely on broad, untargeted scans with minimal filtering. The activity is largely automated and opportunistic in nature.
In addition, according to the CrowdSec network, attack volume against CVE-2025-22457 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit this vulnerability by sending specially crafted HTTP requests with an oversized `X-Forwarded-For` header to the `/dana-na/auth/url_default/welcome.cgi` endpoint, aiming to trigger a stack-based buffer overflow and achieve remote code execution.

## Timeline

- 2025-04-03: CVE Published. CVE-2025-22457 is published to NVD.
- 2025-04-04: CISA KEV. CVE-2025-22457 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-04-11: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2025-09-03: Rule Released. CrowdSec releases a rule to detect CVE-2025-22457 exploitation attempts against the CrowdSec Network.
- 2025-09-03: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-22457 for the first time.

## References

- https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457
- https://github.com/projectdiscovery/nuclei-templates/blob/main/code/cves/2025/CVE-2025-22457.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-22457) follows observed exploitation activity for CVE-2025-22457. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.