erroneo.us
Search all guides⌘K

Security Digest · Jan 8, 2025 · Vulnerability · Network edge

Ivanti Connect Secure Zero-Day RCE (CVE-2025-0282)

Unauthenticated stack overflow in Ivanti Connect Secure before 22.7R2.5, exploited by a China-nexus actor from Dec 2024. Patched; verify and hunt.

Published By erroneo.us Security Desk · Updated 3 min read6 sources

Our verdict

Check exposure

A real zero-day used for espionage and patched in January 2025; if you ran Connect Secure below 22.7R2.5 last winter, a clean patch level today does not prove you were never backdoored.

Who must act: Organizations that ran internet-facing Ivanti Connect Secure on 22.7R2.4 or earlier in December 2024 or January 2025, and anyone who never factory-reset after patching.

Who can relax: Teams that have run Connect Secure 22.7R2.5 or later since early January 2025 with clean external ICT scans, and Policy Secure or ZTA users, for which Ivanti reported no exploitation.

Affected
Ivanti Connect Secure 22.7R2 through 22.7R2.4
Ivanti Policy Secure 22.7R1 through 22.7R1.2
Ivanti Neurons for ZTA gateways 22.7R2 through 22.7R2.3 (per CVE record)
Fixed in
Ivanti Connect Secure 22.7R2.5
Ivanti Policy Secure and ZTA gateways: later builds per Ivanti advisory
CVSS
9.0 (v3.1, CNA)
EPSS
100.0% (percentile 100.0)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Confirm Connect Secure is on 22.7R2.5 or later, and Policy Secure and ZTA gateways are on the builds Ivanti lists as fixed.
  2. Run the external Integrity Checker Tool and keep a history of results; a scan that ends early is a red flag.
  3. If the appliance was exposed and unpatched in Dec 2024 or Jan 2025 and was never factory-reset, factory-reset it (clean image for virtual or cloud) and reapply the patch.
  4. If compromise is suspected, revoke and reissue certificates, API keys, the admin enable password and local and service-account passwords; reset linked domain accounts twice and revoke Kerberos tickets.
  5. Forward appliance logs to an external SIEM so tampering on the box cannot erase them.

How to check if you are affected or compromised

  • External and internal ICT results showing new or mismatched files, or scans completing fewer steps than normal.
  • Mandiant file indicators such as /tmp/.t, /tmp/svb, /tmp/cmdmmap.kuwMW, web shells getComponent.cgi, restAuth.cgi or compcheckresult.cgi, and a modified /home/bin/remotedebug.
  • Anti-forensic signs: cleared dmesg, gaps in debuglog or audit.log, SELinux set permissive, or iptables rules dropping outbound syslog on 514/6514.
  • Sequential requests for /dana-cached/hc/hc_launcher.*.jar version files from VPS or Tor addresses (reconnaissance).

What happened#

On January 8, 2025, Ivanti disclosed two stack-based buffer overflows in Connect Secure, Policy Secure and Neurons for ZTA gateways. CVE-2025-0282 lets a remote, unauthenticated attacker execute code. Ivanti, as the CNA, scores it 9.0 (CVSS 3.1). CVE-2025-0283 (7.0) is a local privilege escalation for an attacker who is already authenticated. Ivanti said a limited number of Connect Secure appliances had been exploited through CVE-2025-0282 at disclosure. Its Integrity Checker Tool (ICT) caught the activity. CISA added CVE-2025-0282 to KEV the same day.

Mandiant traced zero-day exploitation back to mid-December 2024. It attributed the activity to UNC5221, a suspected China-nexus espionage cluster that earlier exploited Ivanti in 2023-24. Mandiant documented the malware: PHASEJAM, a dropper that plants web shells and blocks upgrades; DRYHOOK, a credential harvester; and the SPAWN family of tunneler, SSH backdoor and log-tampering tools.

watchTowr traced the bug to the IF-T/TLS handler. A clientCapabilities string is copied into a 256-byte stack buffer using the source length instead of the destination size. watchTowr published its walkthrough on January 12 and said it would hold back its proof of concept until January 16.

Who is affected#

According to the CVE record, Connect Secure before 22.7R2.5 is vulnerable, along with Policy Secure 22.7R1 through 22.7R1.2 and ZTA gateways up to 22.7R2.3. Connect Secure 22.7R2.5 shipped on January 8. Fixed builds for Policy Secure and ZTA gateways are listed in Ivanti's advisory, which we could not load for this brief, so check it for exact versions. Ivanti said it saw no exploitation of Policy Secure or ZTA gateways. Policy Secure is normally not internet-facing.

Do you really need to act?#

If you patched in January 2025 and have upgraded since, the vulnerability itself is no longer a live risk. The open question is whether anyone got in before you patched. That is why the verdict is check-exposure rather than relax.

Three facts make "patched" an incomplete answer. First, PHASEJAM was built to survive and fake upgrades. Second, Mandiant saw attackers recalculate hashes and re-sign the ICT manifest to evade the checker. Third, in April 2025 CISA updated its guidance after finding the RESURGE malware variant, which could undermine the earlier mitigations. CISA's advice was to factory-reset even when no compromise is found, for the highest confidence. CISA's KEV entry flags known ransomware use. A VPN appliance that was owned in that window is a standing foothold into your identity systems.

What to do now#

  1. Check the running version in the admin console. Connect Secure should be on 22.7R2.5 or later.
  2. Run the external ICT and compare it with earlier runs. A scan that completes fewer steps than usual is suspicious.
  3. If the box was exposed and below 22.7R2.5 during December 2024 or January 2025 and was never factory-reset, reset it now. Use a known-clean external image for virtual or cloud deployments, then patch.
  4. If you find evidence of compromise, follow CISA's list. Revoke and reissue certificates, API keys, the admin enable password and local and auth-server service-account passwords. Reset affected domain account passwords twice, revoke Kerberos tickets, and revoke cloud tokens.
  5. Ship appliance logs off-box so on-device log tampering cannot erase them.

How to tell if you were hit#

Mandiant's indicators include staging files such as /tmp/.t, /tmp/svb and /tmp/cmdmmap.kuwMW, which holds encrypted harvested credentials. Look for the web shells getComponent.cgi, restAuth.cgi and compcheckresult.cgi, a /home/bin/remotedebug replaced by a shell wrapper, and modified DSAuth.pm or DSUpgrade.pm. Anti-forensic signs matter just as much: empty dmesg, gaps in debuglog or audit.log, SELinux switched to permissive, and iptables rules dropping outbound syslog on ports 514 and 6514. Reconnaissance shows up as sequential requests for /dana-cached/hc/hc_launcher.*.jar from VPS or Tor addresses.

Timeline#

  • — Earliest zero-day exploitation identified by Mandiant.
  • — Ivanti discloses CVE-2025-0282 and CVE-2025-0283 and ships Connect Secure 22.7R2.5. CISA adds CVE-2025-0282 to KEV.
  • — watchTowr publishes its root-cause and exploitation walkthrough.
  • — CISA publishes a RESURGE malware analysis report.
  • — CISA revises its mitigation guidance because of RESURGE.

Vulnerability records

  • CVE-2025-0282 · KEV 2025-01-08 · A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA…
  • CVE-2025-0283 · A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. CVE Program — CVE-2025-0282 record (Ivanti CNA) cveawg.mitre.org
  2. CVE Program — CVE-2025-0283 record (Ivanti CNA) cveawg.mitre.org
  3. Ivanti — Security Update: Ivanti Connect Secure, Policy Secure and Neurons for ZTA Gateways ivanti.com
  4. CISA — Ivanti Releases Security Updates to Connect Secure, Policy Secure, and ZTA Gateways cisa.gov
  5. Google Cloud / Mandiant — Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation cloud.google.com
  6. watchTowr Labs — Exploitation Walkthrough and Techniques: Ivanti Connect Secure RCE (CVE-2025-0282) labs.watchtowr.com