High WID-SEC-2025-2010 11 CVEs

Ivanti Connect Secure und Policy Secure: Mehrere Schwachstellen

Published Sep 9, 2025 · Updated Sep 9, 2025 · de-DE

Vendor: ivanti Product: Connect Secure Product: Policy Secure

Summary

Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen in Ivanti Connect Secure und Ivanti Policy Secure ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.

Product

Connect Secure bietet TLS- und mobile VPN-Lösungen.
Ivanti Policy Secure ist eine Network Access Control (NAC) Lösung.

Vulnerabilities 11

High 8.9

CVE-2025-55145

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

ivanti Policy Secure ZTA Gateway Neurons for Secure Access Network devices

Sep 9, 2025
High 8.8

CVE-2025-55141

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025
High 8.8

CVE-2025-55142

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025
High 8.8

CVE-2025-55147

CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025
High 7.6

CVE-2025-55148

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025
Medium 6.8

CVE-2025-55139

SSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025
Medium 6.1

CVE-2025-55143

Reflected text injection in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivan…

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025
Medium 5.4

CVE-2025-55144

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025
Medium 5.4

CVE-2025-8711

CSRF in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway befor…

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025
Medium 5.4

CVE-2025-8712

Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti …

ivanti Policy Secure ZTA Gateway Neurons for Secure Access Network devices

Sep 9, 2025
Medium 4.9

CVE-2025-55146

An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Iva…

ivanti Connect Secure Policy Secure ZTA Gateway Network devices

Sep 9, 2025

Revision history

2025-09-09 #1
Initiale Fassung

References

September Security Advisory Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access vom 2025-09-09
https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US