erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: January 8, 2025

1 editorial brief, 1 known exploited (cisa kev) addition and 1 critical advisory.

All digests · RSS · Markdown

Take stock

  • Check exposure: Ivanti Connect Secure Zero-Day RCE (CVE-2025-0282). Organizations that ran internet-facing Ivanti Connect Secure on 22.7R2.4 or earlier in December 2024 or January 2025, and anyone who never factory-reset after patching.
  • Do you run any of these? Ivanti Connect Secure, Policy Secure, and ZTA Gateways. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2025-01-15.
  • Maven: 1 critical advisory (org.apache.openmeetings:openmeetings-parent). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2025-0282, CVE-2025-0283

Ivanti Connect Secure Zero-Day RCE (CVE-2025-0282)

A real zero-day used for espionage and patched in January 2025; if you ran Connect Secure below 22.7R2.5 last winter, a clean patch level today does not prove you were never backdoored.

Must act: Organizations that ran internet-facing Ivanti Connect Secure on 22.7R2.4 or earlier in December 2024 or January 2025, and anyone who never factory-reset after patching.

Can relax: Teams that have run Connect Secure 22.7R2.5 or later since early January 2025 with clean external ICT scans, and Policy Secure or ZTA users, for which Ivanti reported no exploitation.

  1. Confirm Connect Secure is on 22.7R2.5 or later, and Policy Secure and ZTA gateways are on the builds Ivanti lists as fixed.
  2. Run the external Integrity Checker Tool and keep a history of results; a scan that ends early is a red flag.
  3. If the appliance was exposed and unpatched in Dec 2024 or Jan 2025 and was never factory-reset, factory-reset it (clean image for virtual or cloud) and reapply the patch.

Read the brief →

Known exploited (CISA KEV) 1

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

CVEProduct and flawCISA due
CVE-2025-0282Ivanti Connect Secure, Policy Secure, and ZTA Gateways
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Ransomware		2025-01-15

Critical advisories by ecosystem 1

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 1

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>