CVE-2025-22457

Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability

Severity Score

9.0

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

Yes

*KEV

Decision

Act

*SSVC

Descriptions

MITRE
CISA

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.

*Credits: N/A

CVSS Scores

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Attack Vector

Network

Attack Complexity

Low

Authentication

None

Confidentiality

Complete

Integrity

Complete

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:Act

Exploitation

Active

Automatable

Tech. Impact

Total

* Organization's Worst-case Scenario

Timeline

2025-01-07 CVE Reserved
2025-04-03 CVE Published
2025-04-04 Exploited in Wild
2025-04-08 First Exploit
2025-04-11 KEV Due Date
2025-04-24 CVE Updated
2025-06-10 EPSS Updated

CWE

CWE-121: Stack-based Buffer Overflow

CAPEC

CAPEC-100: Overflow Buffers

References (10)

URL	Tag	Source
https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457
https://attackerkb.com/topics/0ybGQIkHzR/cve-2025-22457/rapid7-analysis

URL	Date	SRC
https://packetstorm.news/files/id/190444	2025-04-11
https://packetstorm.news/files/id/193082	2025-05-16
https://github.com/Vinylrider/ivantiunlocker	2025-04-13
https://github.com/N4SL1/CVE-2025-22457-PoC	2025-04-08
https://github.com/sfewer-r7/CVE-2025-22457	2025-04-22
https://github.com/securekomodo/CVE-2025-22457	2025-04-23
https://github.com/llussiess/CVE-2025-22457	2025-04-12
https://github.com/TRone-ux/CVE-2025-22457	2025-05-25

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Ivanti Search vendor "Ivanti"		Connect Secure Search vendor "Ivanti" for product "Connect Secure"				*		-		Affected
Ivanti Search vendor "Ivanti"		Neurons For Zero-trust Access Search vendor "Ivanti" for product "Neurons For Zero-trust Access"				*		-		Affected
Ivanti Search vendor "Ivanti"		Policy Secure Search vendor "Ivanti" for product "Policy Secure"				*		-		Affected