CVE-2025-22457

The flaw consists of a stack-based buffer overflow in the components of Ivanti Connect Secure, Policy Secure and ZTA Gateways. An attacker sends a specially crafted network request without the need for authentication, which causes the allocated stack buffer to be exceeded and critical process control data to be overwritten. As a result, it is possible to hijack control of the code execution flow and execute arbitrary instructions in the context of the vulnerable service.

A remote, unauthenticated attacker can gain full remote code execution (RCE) on the vulnerable device, which in practice means the possibility of complete system takeover, theft of authentication credentials, establishment of a backdoor, and further lateral movement in the victim's network.

Products must be updated immediately to the following versions: Ivanti Connect Secure to version 22.7R2.6 or later, Ivanti Policy Secure to version 22.7R1.4 or later, Ivanti ZTA Gateways to version 22.8R2.2 or later. Details are available in the vendor's bulletin from April 2025.

Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, Ivanti ZTA Gateways before version 22.8R2.2

Apply mitigations as set forth in the CISA instructions linked below.

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contains a stack-based buffer overflow vulnerability that allows a remote unauthenticated attacker to achieve remote code execution.