Ivanti warns of new Connect Secure flaw used in zero-day attacks

The latest news on the Ivanti Connect Secure vulnerability involves a zero-day attack that was recently disclosed and addressed by Ivanti. Here are the key highlights:

1. Vulnerability Disclosure:

   • Ivanti has disclosed two vulnerabilities affecting its Connect Secure, Policy Secure, and Neurons for Zero Trust Access (ZTA) gateways14.
   • The vulnerabilities are stack-based buffer overflows, with CVE-2025-0282 being a remotely exploitable code execution flaw and CVE-2025-0283 allowing a local authenticated attacker to escalate privileges14.

2. In-the-Wild Exploitation:

   • Ivanti has confirmed that CVE-2025-0282 has been exploited in the wild, affecting a "limited number" of customers' Ivanti Connect Secure appliances14.
   • There is no indication that CVE-2025-0283 has been exploited or chained with CVE-2025-02821.

3. Patch Availability:

   • Patches are available for supported versions of Ivanti Connect Secure, with updates for Policy Secure and Neurons for ZTA gateways expected on January 21, 202514.
   • Ivanti recommends using the Integrity Checker Tool (ICT) to verify if the image installed on Connect Secure appliances has been modified. If changes are detected, customers should perform a factory reset and update to the fixed version (v22.7R2.5)14.

4. Impact on Cybersecurity:

   • The exploitation of these vulnerabilities highlights the ongoing threat of zero-day attacks and the importance of timely patching and vulnerability management in maintaining robust cybersecurity14.
   • Ivanti's prompt response and collaboration with security firms like Google’s Mandiant and Microsoft’s Threat Intelligence Center demonstrate the company's commitment to addressing such threats effectively1.

In summary, the recent zero-day attack on Ivanti Connect Secure underscores the need for continuous vigilance and swift action in addressing emerging vulnerabilities to ensure the integrity of cybersecurity systems.