by Kastro
Paper/Archive/CVE-2025-22457

CVE-2025-22457

Ivanti Connect Secure — Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

KEV · due 11 Aprransomware useEPSS 100%public exploitSSVC actCVSS 9.0
critical.is priorityof 100
97
CVSS 9.0 (CNA)9.0 / 10 × 3027.0In CISA KEV+3030.0EPSS percentile 100.01.000 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

Affected

ProductAffectedFixed inSource
Connect Securesee advisory22.7R2.6CNA
Policy Securesee advisory22.7R1.4CNA
Neurons for ZTA gatewayssee advisory22.8R2.2CNA

Scores by source

ivanti (CNA)9.0CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refforums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22457kevcisa.gov/known-exploited-vulnerabilities-catalog