China-backed espionage group hits Ivanti customers again
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2024-21887+1 related CVE | Command Injection RCE in Ivanti Connect Secure and Policy Secure | 9.1 group max | 100% | KEVRansomwarePoC | KEV |
| CVE-2025-0282 | Unauthenticated RCE in Ivanti Connect Secure, Policy Secure, and ZTA Gateways | 9.0 | 100% | KEVRansomwarePoC ×3 | KEV |
| CVE-2025-22457 | Unauthenticated Stack Buffer Overflow RCE in Ivanti Connect Secure | 9.8 | 100% | KEVRansomware | KEV |
From the original article
4 min read at cyberscoop.com
UNC5221 has a knack for exploiting defects in Ivanti products. The group has exploited at least four vulnerabilities in the vendor’s products since 2023, according to Mandiant. The Chinese national flag flies outside the Ministry of Foreign Affairs in Beijing on July 26, 2023.
By @CyberScoopNews · cyberscoop.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.