CVE-2025-0283 is a stack-based buffer overflow vulnerability affecting Ivanti Connect Secure, Policy Secure, and Neurons for ZTA gateways. This flaw allows a local, authenticated attacker to escalate privileges. Rated with a CVSS score of 7.0 (HIGH), it has a high potential for impact on confidentiality, integrity, and availability, though it requires high attack complexity. While there is no public exploit code available, the vulnerability is being actively exploited as a zero-day in the wild, as indicated by significant media coverage and community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* | ||
>= 22.2, < 22.7CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:-:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:r1:*:*:*:*:*:* | ||
9.1CPE matchmatch criteria | cpe:2.3:a:ivanti:connect_secure:9.1:r1.0:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.4 InfoSec Media, 0.1 Vendor Blog, and 0.0 Security Researcher mentions.