Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability (CVE-2025-0282)
Severity: critical · Patch status: unknown · Since 2025-01-08 · CVE-2025-0282
Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution. CISA added CVE-2025-0282 to its Known Exploited Vulnerabilities catalog on Jan 8, 2025, which means attackers are exploiting it in the wild. CISA reports known use in ransomware campaigns.
What to do
- Apply mitigations as set forth in the CISA instructions linked below to include conducting hunt activities, taking remediation actions if applicable, and applying updates prior to returning a device to service.
- US federal agencies must remediate by Jan 15, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
