---
title: "Ivanti Connect Secure Zero-Day RCE (CVE-2025-0282)"
url: https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2025-0282/
description: "Unauthenticated stack overflow in Ivanti Connect Secure before 22.7R2.5, exploited by a China-nexus actor from Dec 2024. Patched; verify and hunt."
type: security-brief
section: "Security Digest"
date_published: 2025-01-08
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-0282", "CVE-2025-0283"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Ivanti Connect Secure Zero-Day RCE (CVE-2025-0282)

**Verdict: Check exposure.** A real zero-day used for espionage and patched in January 2025; if you ran Connect Secure below 22.7R2.5 last winter, a clean patch level today does not prove you were never backdoored.

- **Who must act:** Organizations that ran internet-facing Ivanti Connect Secure on 22.7R2.4 or earlier in December 2024 or January 2025, and anyone who never factory-reset after patching.
- **Who can relax:** Teams that have run Connect Secure 22.7R2.5 or later since early January 2025 with clean external ICT scans, and Policy Secure or ZTA users, for which Ivanti reported no exploitation.
- **Affected:** Ivanti Connect Secure 22.7R2 through 22.7R2.4; Ivanti Policy Secure 22.7R1 through 22.7R1.2; Ivanti Neurons for ZTA gateways 22.7R2 through 22.7R2.3 (per CVE record)
- **Fixed:** Ivanti Connect Secure 22.7R2.5; Ivanti Policy Secure and ZTA gateways: later builds per Ivanti advisory
- **CVEs:** CVE-2025-0282, CVE-2025-0283
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm Connect Secure is on 22.7R2.5 or later, and Policy Secure and ZTA gateways are on the builds Ivanti lists as fixed.
2. Run the external Integrity Checker Tool and keep a history of results; a scan that ends early is a red flag.
3. If the appliance was exposed and unpatched in Dec 2024 or Jan 2025 and was never factory-reset, factory-reset it (clean image for virtual or cloud) and reapply the patch.
4. If compromise is suspected, revoke and reissue certificates, API keys, the admin enable password and local and service-account passwords; reset linked domain accounts twice and revoke Kerberos tickets.
5. Forward appliance logs to an external SIEM so tampering on the box cannot erase them.

### How to check if you are affected

- External and internal ICT results showing new or mismatched files, or scans completing fewer steps than normal.
- Mandiant file indicators such as /tmp/.t, /tmp/svb, /tmp/cmdmmap.kuwMW, web shells getComponent.cgi, restAuth.cgi or compcheckresult.cgi, and a modified /home/bin/remotedebug.
- Anti-forensic signs: cleared dmesg, gaps in debuglog or audit.log, SELinux set permissive, or iptables rules dropping outbound syslog on 514/6514.
- Sequential requests for /dana-cached/hc/hc_launcher.*.jar version files from VPS or Tor addresses (reconnaissance).

## What happened

On January 8, 2025, Ivanti disclosed two stack-based buffer overflows in Connect Secure, Policy Secure and Neurons for ZTA gateways. [CVE-2025-0282](https://cveawg.mitre.org/api/cve/CVE-2025-0282) lets a remote, unauthenticated attacker execute code. Ivanti, as the CNA, scores it 9.0 (CVSS 3.1). [CVE-2025-0283](https://cveawg.mitre.org/api/cve/CVE-2025-0283) (7.0) is a local privilege escalation for an attacker who is already authenticated. Ivanti said [a limited number of Connect Secure appliances](https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways) had been exploited through CVE-2025-0282 at disclosure. Its Integrity Checker Tool (ICT) caught the activity. CISA added CVE-2025-0282 to KEV the same day.

[Mandiant](https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day) traced zero-day exploitation back to mid-December 2024. It attributed the activity to UNC5221, a suspected China-nexus espionage cluster that earlier exploited Ivanti in 2023-24. Mandiant documented the malware: PHASEJAM, a dropper that plants web shells and blocks upgrades; DRYHOOK, a credential harvester; and the SPAWN family of tunneler, SSH backdoor and log-tampering tools.

[watchTowr](https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/) traced the bug to the IF-T/TLS handler. A `clientCapabilities` string is copied into a 256-byte stack buffer using the source length instead of the destination size. watchTowr published its walkthrough on January 12 and said it would hold back its proof of concept until January 16.

## Who is affected

According to the CVE record, Connect Secure before 22.7R2.5 is vulnerable, along with Policy Secure 22.7R1 through 22.7R1.2 and ZTA gateways up to 22.7R2.3. Connect Secure 22.7R2.5 shipped on January 8. Fixed builds for Policy Secure and ZTA gateways are listed in Ivanti's advisory, which we could not load for this brief, so check it for exact versions. Ivanti said it saw no exploitation of Policy Secure or ZTA gateways. Policy Secure is normally not internet-facing.

## Do you really need to act?

If you patched in January 2025 and have upgraded since, the vulnerability itself is no longer a live risk. The open question is whether anyone got in before you patched. That is why the verdict is check-exposure rather than relax.

Three facts make "patched" an incomplete answer. First, PHASEJAM was built to survive and fake upgrades. Second, Mandiant saw attackers recalculate hashes and re-sign the ICT manifest to evade the checker. Third, in April 2025 [CISA updated its guidance](https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways) after finding the RESURGE malware variant, which could undermine the earlier mitigations. CISA's advice was to factory-reset even when no compromise is found, for the highest confidence. CISA's KEV entry flags known ransomware use. A VPN appliance that was owned in that window is a standing foothold into your identity systems.

## What to do now

1. Check the running version in the admin console. Connect Secure should be on 22.7R2.5 or later.
2. Run the external ICT and compare it with earlier runs. A scan that completes fewer steps than usual is suspicious.
3. If the box was exposed and below 22.7R2.5 during December 2024 or January 2025 and was never factory-reset, reset it now. Use a known-clean external image for virtual or cloud deployments, then patch.
4. If you find evidence of compromise, follow CISA's list. Revoke and reissue certificates, API keys, the admin enable password and local and auth-server service-account passwords. Reset affected domain account passwords twice, revoke Kerberos tickets, and revoke cloud tokens.
5. Ship appliance logs off-box so on-device log tampering cannot erase them.

## How to tell if you were hit

Mandiant's indicators include staging files such as `/tmp/.t`, `/tmp/svb` and `/tmp/cmdmmap.kuwMW`, which holds encrypted harvested credentials. Look for the web shells `getComponent.cgi`, `restAuth.cgi` and `compcheckresult.cgi`, a `/home/bin/remotedebug` replaced by a shell wrapper, and modified `DSAuth.pm` or `DSUpgrade.pm`. Anti-forensic signs matter just as much: empty `dmesg`, gaps in `debuglog` or `audit.log`, SELinux switched to permissive, and iptables rules dropping outbound syslog on ports 514 and 6514. Reconnaissance shows up as sequential requests for `/dana-cached/hc/hc_launcher.*.jar` from VPS or Tor addresses.

## Timeline

- Mid-Dec 2024 — Earliest zero-day exploitation identified by Mandiant.
- Jan 8, 2025 — Ivanti discloses CVE-2025-0282 and CVE-2025-0283 and ships Connect Secure 22.7R2.5. CISA adds CVE-2025-0282 to KEV.
- Jan 12, 2025 — watchTowr publishes its root-cause and exploitation walkthrough.
- Mar 28, 2025 — CISA publishes a RESURGE malware analysis report.
- Apr 8, 2025 — CISA revises its mitigation guidance because of RESURGE.

## Sources

1. [CVE Program — CVE-2025-0282 record (Ivanti CNA)](https://cveawg.mitre.org/api/cve/CVE-2025-0282)
2. [CVE Program — CVE-2025-0283 record (Ivanti CNA)](https://cveawg.mitre.org/api/cve/CVE-2025-0283)
3. [Ivanti — Security Update: Ivanti Connect Secure, Policy Secure and Neurons for ZTA Gateways](https://www.ivanti.com/blog/security-update-ivanti-connect-secure-policy-secure-and-neurons-for-zta-gateways)
4. [CISA — Ivanti Releases Security Updates to Connect Secure, Policy Secure, and ZTA Gateways](https://www.cisa.gov/news-events/alerts/2025/01/08/ivanti-releases-security-updates-connect-secure-policy-secure-and-zta-gateways)
5. [Google Cloud / Mandiant — Ivanti Connect Secure VPN Targeted in New Zero-Day Exploitation](https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day)
6. [watchTowr Labs — Exploitation Walkthrough and Techniques: Ivanti Connect Secure RCE (CVE-2025-0282)](https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/)

---
Source page: https://erroneo.us/security/briefs/ivanti-connect-secure-cve-2025-0282/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt