Ivanti Discloses Multiple Vulnerabilities: CVE-2025-0282 and CVE-2025-0283

On January 8, 2025, multiple vulnerabilities in Ivanti products were disclosed, highlighting significant security risks in products that manage access to critical network areas. These vulnerabilities, CVE-2025-0282 and CVE-2025-0283, allow remote code execution and privilege escalation, respectively. Due to their high impact and the active exploitation of one vulnerability, organizations must act swiftly to protect their systems. Below is an overview of the issue, but if you want to know more or consult with out A.I. Assistant then go to our CVE report pages: CVE-2025-0282 & CVE-2025-0283.

Vulnerability Overview

CVE-2025-0282: Remote Code Execution (Critical, CVSS 9.0)

• Description: A stack-based buffer overflow in the web components of Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA Gateways allows remote, unauthenticated attackers to execute arbitrary code and bypass access controls.
• Exploitation: Active exploitation observed. Attackers have used anti-forensic techniques and malware such as SPAWN to maintain access.

CVE-2025-0283: Privilege Escalation (High, CVSS 7.0)

• Description: A stack-based buffer overflow enables local authenticated attackers to escalate privileges and potentially access restricted resources.
• Exploitation: No active exploitation reported as of now.

Affected Products and Versions

The following products and versions are vulnerable:

• Ivanti Connect Secure: Versions before 22.7R2.5
• Ivanti Policy Secure: Versions before 22.7R1.2
• Ivanti Neurons for ZTA Gateways: Versions before 22.7R2.3

Impact and Risk Assessment

• CVE-2025-0282: High impact and risk due to its remote, unauthenticated nature and observed active exploitation. Often internet-facing, increasing exposure.
• CVE-2025-0283: High impact but medium risk, requiring an authenticated user for exploitation.

Determining Vulnerability

Steps to Check for Vulnerability:

Use Ivanti's Integrity Checker Tool (ICT):

• ICT identifies signs of compromise or improper configurations. Ensure you have the latest version (ICT-V22725, build 3819).
• Compare results with Ivanti's documented outputs to identify anomalies.

Inspect Product Versions:

• Verify your Ivanti product versions against the list of affected versions.

Monitor Network Activity:

• Look for indicators of compromise (IoCs) such as unusual traffic patterns or unauthorized changes to appliances.

Mitigation Measures

For Ivanti Connect Secure:

• Immediate Actions:
  • Upgrade to version 22.7R2.5.
  • Perform a factory reset of the appliance for enhanced security.
• Ongoing Monitoring:
  • Regularly use ICT to detect any exploitation attempts.

For Ivanti Policy Secure and Neurons for ZTA Gateways:

• Patches:
  • Updates will be available on January 21, 2025.
• Temporary Recommendations:
  • Take Policy Secure appliances offline if exposed to the internet.
  • Disable unprivileged accounts in Neurons for ZTA Gateways.

What to Do if You Are Affected

1. Contact Ivanti Support: Open a case via the Ivanti Success Portal if you suspect compromise or need assistance.
2. Isolate Compromised Systems: Disconnect affected appliances from the network, perform a factory reset, and reapply updates.
3. Enhance Security Monitoring: Deploy intrusion detection systems (IDS) and review logs for anomalous activities.
4. Change Credentials: Reset all user credentials and update certificates post-compromise.

Conclusion

The vulnerabilities in Ivanti products underline the importance of proactive security measures. If you suspect exposure to these vulnerabilities, act immediately by deploying patches, monitoring network activity, and leveraging tools like ICT. Organizations must stay vigilant to prevent potential breaches and mitigate risks associated with these high-severity vulnerabilities.

Sources: Northwave & Security.nl