Ivanti Connect Secure Stack Overflow RCE (IF-T/TLS)
- Product
- Ivanti Connect Secure / Policy Secure / ZTA Gateways
- CVE
- CVE-2025-0282
- Disclosed
- 2025-01-08
- CVSS
- 9
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Ivanti Connect Secure before 22.7R2.5, Policy Secure before 22.7R1.2, Neurons for ZTA gateways before 22.7R2.3.
- Fixed
- Connect Secure 22.7R2.5; Policy Secure 22.7R1.2; ZTA gateways 22.7R2.3.
Summary
A stack-based buffer overflow in Ivanti Connect Secure allowed unauthenticated remote code execution and was exploited as a zero-day by a China-nexus cluster (UNC5337/UNC5221). Mandiant documented SPAWN-family malware deployed after exploitation.
Root cause
While processing IF-T/TLS client connection data, the web server copies a client-supplied capabilities field into a fixed-size stack buffer using the source length rather than the destination size. This overflow can overwrite saved data on the stack and lead to code execution.
Impact
Unauthenticated code execution on the VPN appliance, with persistent implants that can survive upgrades.
Detection
Run Ivanti's Integrity Checker Tool, check version, and look for web process crashes; watchTowr and Mandiant published IOCs.
Mitigation
Upgrade, factory reset if ICT reports issues, and rotate credentials.