Skip to content
OpenAdvisories
Critical · 9.0 Known exploited · Ransomware Scanner template Public exploit CVE-2025-0282 EUVD-2025-1580GHSA-rf94-f4r9-6gxh

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Ne…

Published Jan 8, 2025 · Updated Oct 1, 2026 · Assigned by ivanti

Vendor: ivanti Product: Connect Secure Product: Neurons for ZTA gateways Product: Policy Secure Category: Network devices

Description

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.

Affected products

VendorProductAffectedFixed
Ivanti Connect Secure 22.7R2 – ≤ 22.7R2.4 22.7R2.5
Ivanti Policy Secure 22.7R1 – ≤ 22.7R1.2 —
Ivanti Neurons for ZTA gateways 22.7R2 – ≤ 22.7R2.3 22.7R2.5

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Exploit-DB 1

GitHub 10 repositories

  • absholi7ly/CVE-2025-0282-Ivanti-exploit ★ 53 · Jan 11, 2025

    CVE-2025-0282 is a critical vulnerability found in Ivanti Connect Secure, allowing Remote Command Execution (RCE) through a buffer overflow exploit.

  • sfewer-r7/CVE-2025-0282 ★ 50 · Jan 16, 2025

    PoC for CVE-2025-0282: A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways

  • watchtowrlabs/CVE-2025-0282 ★ 31 · Jan 15, 2025

    Ivanti Connect Secure IFT TLS Stack Overflow pre-auth RCE (CVE-2025-0282)

  • Hexastrike/Ivanti-Connect-Secure-Logs-Parser ★ 6 · Jan 19, 2025

    A Python script for examining Ivanti Secure Connect (ICS) event logs, designed to support investigations into vulnerabilities CVE-2025-0282, CVE-2023-46805, and CVE-2024-21887.

  • AnonStorks/CVE-2025-0282-Full-version ★ 4 · Jan 12, 2025

    # CVE-2025-0282: Remote Code Execution Vulnerability in [StorkS]

  • AdaniKamal/CVE-2025-0282 ★ 2 · Jan 28, 2025

    Ivanti Connect Secure, Policy Secure & ZTA Gateways - CVE-2025-0282

  • almanatra/CVE-2025-0282 ★ 2 · Jan 22, 2025

    Exploit for CVE-2025-0282: A remote unauthenticated stack based buffer overflow affecting Ivanti Connect Secure, Ivanti Policy Secure, and Ivanti Neurons for ZTA gateways

  • rxwx/pulse-meter ★ 1 · Jan 14, 2025

    Parses the System Snapshot from an Ivanti Connect Secure applicance to identify possible IOCs related to CVE-2023-46805, CVE-2024-21887 and CVE-2025-0282.

  • razureink/cve-2025-0282-ivanti_rce_reproduction ★ 0 · Jul 24, 2026

    Reproduction of cve-2025-0282-ivanti_rce_reproduction

  • gmh5225/Blackash-CVE-2025-0282 ★ 0 · Jun 8, 2025

    CVE-2025-0282

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Automated scanner template

A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.

Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.

Advisories 2

References