Ivanti Releases Critical Security Updates for Connect Secure Appliances
Ivanti, a leading provider of IT solutions, has issued urgent security updates to address critical vulnerabilities in its Connect Secure appliances. These vulnerabilities, particularly CVE-2025-0282, have been actively exploited in the wild, posing significant risks to organizations utilizing these products.
The primary vulnerability, CVE-2025-0282, is a stack-based buffer overflow flaw that allows unauthenticated remote code execution on affected devices. This critical vulnerability has been observed in active exploitation, with attackers deploying malware on compromised appliances. Ivanti's investigation, conducted in collaboration with cybersecurity firms Mandiant and Microsoft's Threat Intelligence Center, confirmed the exploitation of this zero-day vulnerability.
In response, Ivanti has released firmware version 22.7R2.5 for Connect Secure appliances, which addresses CVE-2025-0282. Administrators are strongly advised to apply this update immediately to mitigate potential threats. For Ivanti Policy Secure and Neurons for ZTA Gateways, patches are scheduled for release on January 21, 2025. Although there have been no reported exploitations in these products, it is recommended to follow Ivanti's security guidelines and ensure these systems are not exposed to the internet.
Additionally, Ivanti has identified a second vulnerability, CVE-2025-0283, which allows authenticated local attackers to escalate privileges. While there is no evidence of active exploitation of this flaw, it is addressed in the latest security updates.
Administrators should utilize Ivanti's Integrity Checker Tool (ICT) to detect any signs of compromise. If malicious activity is detected, performing a factory reset followed by an upgrade to the latest firmware is recommended to ensure system integrity.
This development underscores the critical importance of timely patch management and continuous monitoring of network appliances to safeguard against emerging threats. Organizations are urged to prioritize the deployment of these security updates to protect their infrastructure.