Ivanti Connect Secure X-Forwarded-For Stack Overflow RCE
- Product
- Ivanti Connect Secure / Policy Secure / ZTA Gateways
- CVE
- CVE-2025-22457
- Disclosed
- 2025-04-03
- CVSS
- 9.8
- Auth
- pre-auth
- CISA KEV
- yes
- Affected
- Connect Secure 22.7R2.5 and earlier (and EOL 9.1x), Policy Secure 22.7R1.3 and earlier, ZTA gateways 22.8R2 and earlier.
- Fixed
- Connect Secure 22.7R2.6 (released 2025-02-11); Policy Secure 22.7R1.4; ZTA 22.8R2.2.
Summary
A stack overflow initially assessed as a non-exploitable denial-of-service bug was patched silently in February 2025, then exploited by UNC5221 after the actor reverse-engineered the fix. It allows unauthenticated remote code execution on unpatched gateways.
Root cause
A request header value is copied into a fixed-size stack buffer without proper bounds checking. The character set is limited to digits and periods, which made exploitation appear impossible, but attackers found a way to achieve code execution regardless.
Impact
Unauthenticated code execution on the VPN, followed by TRAILBLAZE/BRUSHFIRE implants.
Detection
Run Ivanti's external ICT, monitor for web server crashes, and version-check against 22.7R2.6.
Mitigation
Upgrade to 22.7R2.6 or later; migrate off EOL Pulse Connect Secure 9.x.