On April 3, 2025, Ivanti disclosed a critical vulnerability, CVE-2025-22457, affecting several of its products, including Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways.This severe flaw, with a CVSS score of 9.0, is actively being exploited by attackers, posing significant risks to organizations using Ivanti’s VPN and network access solutions. The vulnerability, identified as a stack-based buffer overflow flaw (CWE-121), allows remote, unauthenticated attackers to achieve remote code execution (RCE) due to improper input validation, thereby establishing a substantial threat to network security.
A Widespread Threat
The vulnerability has been actively exploited since mid-March 2025 by a suspected Chinese state-sponsored group known as UNC5221. This group is notorious for targeting edge devices and exploiting Ivanti zero-days, including CVE-2023-46805. The attackers have demonstrated their technical prowess and malicious intent by deploying various malware families such as Trailblaze, an in-memory dropper, Brushfire, a passive backdoor, and the Spawn suite, aimed at credential theft and lateral movement within compromised networks. Their post-exploitation activities have involved tampering with log files using tools like SPAWNSLOTH to evade detection and remain under the radar.
Ivanti’s vulnerability, though initially underestimated, has proven to be a lucrative target for these attackers due to its widespread use in numerous organizations.The attackers’ ability to reverse-engineer patches and develop sophisticated exploits highlights the evolving nature of cyber threats and stresses the importance of timely and accurate vulnerability assessments. The group’s activities pose not only a technical challenge but also underscore the geopolitical implications of cybersecurity breaches, particularly with the involvement of state-sponsored actors.
The Patch and its Implications
Ivanti understood the gravity of the situation by releasing a patch for Connect Secure on February 11, 2025, in version 22.7R2.6. Initially, the flaw was considered a low-risk denial-of-service issue due to its limited character set involving periods and numbers. However, subsequent reverse engineering by attackers allowed them to escalate the vulnerability’s severity, leading to the development of RCE exploits on unpatched systems.This shift in exploitation underscores the dynamic nature of cybersecurity threats and the need for continuous monitoring and quick response.
Affected users of Ivanti Connect Secure (version 22.7R2.5 or earlier) and Pulse Connect Secure 9.1x appliances are urged to promptly update their systems to mitigate the risk. The situation is particularly urgent for users of Pulse Connect Secure, as this product has not been supported since December 31, 2024, making it vulnerable to exploitation.Ivanti recommends contacting them for migration options to ensure continued protection and compatibility with the latest security measures. These proactive steps are crucial in safeguarding network infrastructure and mitigating potential exploitation.
Response and Mitigation Strategies
To mitigate potential exploitation of CVE-2025-22457, Ivanti advises immediate patching and thorough monitoring for any signs of compromise. Users are instructed to upgrade to Ivanti Connect Secure version 22.7R2.6 and apply patches for other affected products as they become available. For instance, a patch for Ivanti Policy Secure, version 22.7R1.4, will be available on April 21, 2025. Although no exploitation has been observed in this product, and it is typically not internet-facing, it remains imperative to patch to reduce any potential risk.
Organizations should also monitor for signs of anomalies using the Integrity Checker Tool (ICT), looking out for indicators such as web server crashes and log tampering. In the event of detected compromises, a factory reset followed by redeployment with the latest patched version is necessary to ensure system integrity. Further mitigation steps and indicators of compromise are detailed through resources such as Mandiant’s blog, providing valuable guidance for organizations to implement comprehensive threat detection and response strategies.Patches for ZTA Gateways should also be applied as they become available. Version 22.8R2.2, set to auto-apply on April 19, 2025, addresses the vulnerability in ZTA Gateways, with no reported exploitation thus far. However, the risk persists for unconnected gateways, necessitating timely updates to ensure protection against potential threats.These collective measures aim to reinforce network defenses and safeguard against the exploitation of such high-risk vulnerabilities.
Systemic Security Challenges
On April 3, 2025, Ivanti revealed a critical security flaw, tagged as CVE-2025-22457, which impacts several of its key products.These products include Connect Secure, Pulse Connect Secure, Ivanti Policy Secure, and ZTA Gateways. The vulnerability is especially alarming, with a Common Vulnerability Scoring System (CVSS) score of 9.0, indicating its severity and the urgent need for attention.Active exploitation of this vulnerability by malicious actors poses a substantial risk to organizations relying on Ivanti’s VPN and network access solutions.
The issue in question is a stack-based buffer overflow flaw, categorized under CWE-121.This flaw permits remote, unauthenticated attackers to achieve remote code execution (RCE) by exploiting insufficient input validation processes. Essentially, this vulnerability allows bad actors to run arbitrary code on affected systems, thereby compromising the security of the networks using Ivanti’s solutions.Companies using these products should prioritize deploying patches and updates to mitigate the risks associated with this significant security threat.