{"id":"CVE-2025-0282","aliases":["EUVD-2025-1580","GHSA-rf94-f4r9-6gxh"],"status":"published","title":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy...","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.","severity":{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.99981,"percentile":0.99981,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-121","CWE-787"],"published":"2025-01-08T22:15:09Z","modified":"2026-10-01T19:17:15Z","kev":{"date_added":"2025-01-08","due_date":"2025-01-15","required_action":"Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.","known_ransomware_use":"Known"},"exploitation":[{"source":"euvd","since":"2025-01-08"},{"source":"kev","since":"2025-01-08"}],"exploits":[{"source":"pocgithub","id":"absholi7ly/CVE-2025-0282-Ivanti-exploit","title":"absholi7ly/CVE-2025-0282-Ivanti-exploit","date":"2025-01-11","url":"https://github.com/absholi7ly/CVE-2025-0282-Ivanti-exploit"},{"source":"pocgithub","id":"AnonStorks/CVE-2025-0282-Full-version","title":"AnonStorks/CVE-2025-0282-Full-version","date":"2025-01-12","url":"https://github.com/AnonStorks/CVE-2025-0282-Full-version"},{"source":"pocgithub","id":"rxwx/pulse-meter","title":"rxwx/pulse-meter","date":"2025-01-14","url":"https://github.com/rxwx/pulse-meter"},{"source":"pocgithub","id":"watchtowrlabs/CVE-2025-0282","title":"watchtowrlabs/CVE-2025-0282","date":"2025-01-15","url":"https://github.com/watchtowrlabs/CVE-2025-0282"},{"source":"pocgithub","id":"sfewer-r7/CVE-2025-0282","title":"sfewer-r7/CVE-2025-0282","date":"2025-01-16","url":"https://github.com/sfewer-r7/CVE-2025-0282"},{"source":"pocgithub","id":"Hexastrike/Ivanti-Connect-Secure-Logs-Parser","title":"Hexastrike/Ivanti-Connect-Secure-Logs-Parser","date":"2025-01-19","url":"https://github.com/Hexastrike/Ivanti-Connect-Secure-Logs-Parser"},{"source":"pocgithub","id":"almanatra/CVE-2025-0282","title":"almanatra/CVE-2025-0282","date":"2025-01-22","url":"https://github.com/almanatra/CVE-2025-0282"},{"source":"pocgithub","id":"AdaniKamal/CVE-2025-0282","title":"AdaniKamal/CVE-2025-0282","date":"2025-01-28","url":"https://github.com/AdaniKamal/CVE-2025-0282"},{"source":"exploitdb","id":"EDB-52213","title":"Ivanti Connect Secure 22.7R2.5 - Remote Code Execution (RCE)","type":"remote","platform":"multiple","date":"2025-04-15","url":"https://www.exploit-db.com/exploits/52213"},{"source":"pocgithub","id":"gmh5225/Blackash-CVE-2025-0282","title":"gmh5225/Blackash-CVE-2025-0282","date":"2025-06-08","url":"https://github.com/gmh5225/Blackash-CVE-2025-0282"},{"source":"pocgithub","id":"razureink/cve-2025-0282-ivanti_rce_reproduction","title":"razureink/cve-2025-0282-ivanti_rce_reproduction","date":"2026-07-24","url":"https://github.com/razureink/cve-2025-0282-ivanti_rce_reproduction"},{"source":"nuclei","id":"CVE-2025-0282","title":"Ivanti Connect Secure - Stack-based Buffer Overflow","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-0282.yaml"}],"products":[{"vendor":"ivanti","product":"connect secure"},{"vendor":"ivanti","product":"connect secure, policy secure, and zta gateways"},{"vendor":"ivanti","product":"connect_secure"},{"vendor":"ivanti","product":"neurons for zta gateways"},{"vendor":"ivanti","product":"neurons_for_zero-trust_access"},{"vendor":"ivanti","product":"policy secure"},{"vendor":"ivanti","product":"policy_secure"}],"references":[{"url":"https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283","tags":["Vendor Advisory"]},{"url":"https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/","tags":["third-party-advisory","Exploit","Third Party Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2025-0282","tags":["government-resource","US Government Resource"]},{"url":"https://github.com/sfewer-r7/CVE-2025-0282","tags":["exploit","Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-0282","tags":["government-resource","US Government Resource"]},{"url":"https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282","tags":["Third Party Advisory","US Government Resource"]},{"url":"https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day","tags":["Exploit","Technical Description"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-0282"},{"url":"https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282"},{"url":"https://www.synacktiv.com/sites/default/files/2024-01/synacktiv-pulseconnectsecure-multiple-vulnerabilities.pdf"},{"url":"https://github.com/advisories/GHSA-rf94-f4r9-6gxh"}],"sources":{"cve":[{"id":"CVE-2025-0282","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.","status":"published","published":"2025-01-08T22:15:09.386Z","modified":"2026-10-01T18:13:43.187Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-121"],"updated_at":"2026-11-02T14:32:53.475217Z"}],"euvd":[{"id":"EUVD-2025-1580","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.","status":"published","published":"2025-01-08T22:15:09Z","modified":"2026-10-01T18:13:43Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2025-01-08","updated_at":"2026-11-02T17:27:44.322377Z"}],"ghsa":[{"id":"GHSA-rf94-f4r9-6gxh","title":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy...","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.","status":"published","published":"2025-01-09T00:31:34Z","modified":"2025-10-22T00:34:17Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T15:04:09.266545Z"}],"kev":[{"id":"CVE-2025-0282","title":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability","description":"Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.","cwes":["CWE-121"],"kev":{"date_added":"2025-01-08","due_date":"2025-01-15","required_action":"Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.","known_ransomware_use":"Known"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2025-0282","description":"A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.","status":"published","published":"2025-01-08T23:15:09.763Z","modified":"2026-10-01T19:17:15.743Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-121","CWE-787"],"updated_at":"2026-11-02T14:10:48.373347Z"}]}}