Ivanti Connect Secure Zero-Day Exploitation: Emerging Threat published on Risk Ledger

Summary

Ivanti have disclosed two vulnerabilities, CVE-2025-0282 and CVE-2025-0283 affecting Ivanti Connect Secure, Policy Secure and ZTA Gateways. CVE-2025-0282 has a CVSS base score of 9.0 (Critical).

Active exploitation of CVE-2025-0282, affecting Connect Secure VPN devices, have been observed. A patch has been released to mitigate this vulnerability.
‍

Threat Description

On January 8, 2025, Ivanti released a security advisory disclosing two vulnerabilities affecting several devices: Ivanti Connect Secure, Policy Secure and ZTA Gateways. The criticality of this advisory was further reinforced with additional public advisories from the UK National Cyber Security Centre (NCSC), the US Cybersecurity and Infrastructure  Security Agency (CISA), and a detailed, technical analysis by Mandiant.

Both vulnerabilities are stack-based buffer overflows that allow for remote code execution by unauthenticated attackers (CVE-2025-0282) and local privilege escalation (CVE-2025-0283) on these Ivanti appliances.

Ivanti is aware of active exploitation of Connect Secure VPN devices through CVE-2025-0282. According to Mandiant, they have observed exploitation of this CVE since mid-December 2024 with a variety of secondary malware deployed. Successful exploitation may enable an attacker to gain access to an organisation’s enterprise network.
‍

Applicability

Organisations using Ivanti Connect Secure, Policy Secure or ZTA Gateways are affected.

Specifically, These vulnerabilities affect all versions of:

• Ivanti Connect Secure before version 22.7R2.5,
• Ivanti Policy Secure before version 22.7R1.2, and
• Ivanti Neurons for ZTA Gateways before version 22.7R2.3

While the full impact of this vulnerability is still unknown, given the widespread attention and response triggered by previous Ivanti and other providers’ VPN vulnerabilities—including multiple government advisories—we assess a potential for a significant impact.
‍

Relevance to the supply chain

Given their critical role in enabling secure remote access to an organisation’s resources, VPNs are extensively used by both clients and suppliers, making them a high-value target for malicious actors.

It is important to assess the potential impact of these vulnerabilities—whether through your organisation’s Ivanti VPN deployments or Ivanti VPNs used by your suppliers. The successful exploitation of a supplier’s VPN could lead to significant disruptions to critical services, create an entry point for attackers into your own network, or even result in the exposure or loss of sensitive data that your suppliers manage on your behalf.
‍

What should you do about it

If your organisation uses the vulnerable Ivanti products listed above, follow the actions outlined in the NCSC Advisory:

1. Run the Ivanti external Integrity Checker Tool (ICT). The ICT offers a snapshot of the current state of the appliance and cannot necessarily detect threat actor activity if the appliance has been returned to a clean state. The ICT does not scan for malware or indicators of compromise (IoCs).
2. Perform a compromise assessment using the IoCs in the Mandiant blog.
3. Before installing updates, Ivanti recommends performing a factory reset.
4. follow Ivanti’s Security Advisory to treat the vulnerabilities including installing the latest security updates as they become available.  Note that:
   • Ivanti Policy Secure: This should not be exposed to the internet.
   • Ivanti Neurons for ZTA gateways: If a gateway for this solution is generated and left unconnected to a ZTA controller, then there is a risk of exploitation.
5. Perform continuous monitoring and threat hunting activities using the IoCs in the Mandiant blog.

Evaluate the potential scope of disruption by assessing which of your suppliers may be affected by this vulnerability. Suppliers will be asked to respond to an Emerging Threat action within the Risk Ledger platform, allowing you to gain visibility into their assessment of exposure to this threat and any treatment they are applying.

Note: Risk Ledger’s search function https://app.riskledger.com/c/answer-search (Beta) - enables authenticated Risk Ledger clients to search their supplier’s answer notes for key phrases e.g. ‘Ivanti’.
‍

Where to find more information

This is an ongoing situation and information will likely be continually updated. The Ivanti advisory contains their latest information and links to tools and patches to aid in investigation and mitigation:

Official Ivanti Security Advisory (CVE-2025-0282, CVE-2025-0283)

Mandiant has a detailed and technical analysis of the vulnerabilties and the tools used in exploitation. Additional context to historical exploits are also provided:

Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation

Advisories from NCSC and CISA:

https://www.ncsc.gov.uk/news/active-exploitation-ivanti-vulnerability

https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways