CVE-2025-55148
BaseFortify
Publication date: 2025-09-09
Last updated on: 2025-09-24
Assigner: ivanti
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ivanti | connect_secure | to 22.7 (exc) |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | connect_secure | 22.7 |
| ivanti | policy_secure | to 22.7 (exc) |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | policy_secure | 22.7 |
| ivanti | zero_trust_access_gateway | 22.8 |
| ivanti | neurons_for_secure_access | to 22.8 (exc) |
| ivanti | neurons_for_secure_access | 22.8 |
| ivanti | neurons_for_secure_access | 22.8 |
| ivanti | neurons_for_secure_access | 22.8 |
| ivanti | neurons_for_secure_access | 22.8 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-862 | The product does not perform an authorization check when an actor attempts to access a resource or perform an action. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a missing authorization issue in certain Ivanti products before specified versions. It allows a remote authenticated attacker who has read-only admin privileges to configure restricted settings that they should not be able to change.
How can this vulnerability impact me? :
An attacker with read-only admin access could exploit this vulnerability to modify restricted configurations, potentially leading to unauthorized changes that could affect system integrity, availability, or confidentiality.
What immediate steps should I take to mitigate this vulnerability?
Apply the fix deployed on 02-Aug-2025 by upgrading Ivanti Connect Secure to version 22.7R2.9 or 22.8R2, Ivanti Policy Secure to version 22.7R1.6 or later, Ivanti ZTA Gateway to version 2.8R2.3-723 or later, and Ivanti Neurons for Secure Access to version 22.8R1.4 or later to prevent unauthorized configuration changes by remote authenticated users with read-only admin privileges.