CVE-2025-0283

—

CVSS 3.1

7.0 high

EPSS

17%p97

Published

Jan 8, 2025 (Jan 8, 2025)

Modified

Jun 17, 2026

Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.

Vendors: ivanti
Products: connect secure, neurons for zero-trust access, policy secure
Weakness: CWE-121, CWE-787
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (17.4%)

In the news7 stories

CISA warns of RESURGE malware exploiting Ivanti flaw

Security AffairsMar 30, 23:13 UTC · Mar 30, 2025Malware in the wildCVE-2025-0282 CVE-2025-0283

Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect Secure and Policy Secure

The Hacker NewsJan 11, 06:31 UTC · Jan 11, 2025Vulnerability in the wildCVE-2025-0282 CVE-2025-0283

New zero

CyberScoopJan 9, 21:51 UTC · Jan 9, 2025Exploit / PoC in the wildCVE-2025-0282 CVE-2025-0283

U.S. CISA adds Ivanti Connect Secure, Policy Secure, and ZTA Gateways flaw to its Known Exploited Vulnerabilities catalog

Security AffairsJan 9, 11:53 UTC · Jan 9, 2025Exploit / PoC in the wildCVE-2025-0282 CVE-2025-0283

CVE-2025-0283

In the news7 stories

CISA warns of RESURGE malware exploiting Ivanti flaw

Ivanti Flaw CVE-2025-0282 Actively Exploited, Impacts Connect Secure and Policy Secure

New zero

U.S. CISA adds Ivanti Connect Secure, Policy Secure, and ZTA Gateways flaw to its Known Exploited Vulnerabilities catalog

Critical Ivanti Zero

Ivanti warns hackers are exploiting new vulnerability

Ivanti Connect Secure zero-day exploited by attackers (CVE-2025-0282)