CVE-2025-0282

Think of this gateway as the locked front door that lets your remote employees securely connect into your company network. This flaw is like a defect in the lock that lets a stranger pick it open from outside, no key needed, and walk in with full control of the building. Attackers are already using this exact trick to break into networks and deploy ransomware.

This matters to you if you run Ivanti Connect Secure, Ivanti Policy Secure, or Ivanti Neurons for ZTA gateways to give employees or partners remote access to your network. There is no reachability gate here — these are internet-facing remote-access devices by design, so if you have one deployed and unpatched, it is exposed.

Attackers are already exploiting this flaw in real ransomware campaigns, and CISA added it to its Known Exploited Vulnerabilities list with a January 15, 2025 remediation deadline — this is not a theoretical risk. Because the device requires no login and no user action to be compromised, any unpatched gateway reachable on the internet should be treated as likely already targeted. Act now, not later.

1. Inventory all Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateway instances and record their current firmware versions.
2. Run Ivanti's Integrity Checker Tool (ICT) on every instance before and after patching to detect signs of prior compromise, given confirmed exploitation by actor UNC5221 and ransomware operators.
3. Upgrade to the fixed versions: Ivanti Connect Secure 22.7R2.5+, Ivanti Policy Secure 22.7R1.2+, Ivanti Neurons for ZTA gateways 22.7R2.5+ (per vendor advisory at forums.ivanti.com).
4. If immediate patching isn't possible, apply Ivanti's interim mitigations and restrict external exposure of the management/admin interfaces; CISA's remediation due date for federal agencies was 2025-01-15, treat this as the baseline deadline for any organization.
5. If ICT or logs show signs of compromise, perform full incident response (credential rotation, certificate reissuance, factory reset/rebuild of the appliance) rather than just patching in place, since attackers with prior RCE access may have persisted.
6. Monitor for anomalous admin sessions, new accounts, and outbound connections from the gateway post-patch; three public PoCs exist on GitHub, so expect continued and automated exploitation attempts against any unpatched instance.

CVSS 9.0 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H) — stack-based buffer overflow (CWE-121/CWE-787) exploitable remotely without authentication or user interaction, scope-changed, yielding full confidentiality/integrity/availability impact. Confirmed in CISA KEV (added 2025-01-08, ransomware use), attributed to actor UNC5221, with sustained press attention. Three public PoCs are available on GitHub, and EPSS scoring places this at the top percentile for predicted exploitation — though given confirmed KEV/ransomware activity, that prediction is moot; exploitation is an established fact, not a forecast.