CVE-2025-22457
Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability
Description
CVE-2025-22457 is a critical stack-based buffer overflow vulnerability in Ivanti Connect Secure, Policy Secure, and ZTA Gateways that enables a remote unauthenticated attacker to achieve remote code execution. These products are widely deployed as VPN and zero trust network access solutions in enterprise environments. With a CVSS v3.1 score of 9.0 and confirmed use in ransomware campaigns, CVE-2025-22457 was added to CISA's Known Exploited Vulnerabilities catalog with an accelerated remediation deadline of just 7 days (April 11, 2025). The EPSS score of 55.5% at the 98th percentile confirms this vulnerability is among the most actively exploited, consistent with Ivanti's history as a high-value target for nation-state and ransomware threat actors.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| ivanti | connect secure | < 22.7; 22.7 |
| ivanti | policy secure | < 22.7; 22.7 |
| ivanti | zero trust access gateway | < 22.8; 22.8 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
CWE-121: Stack-based Buffer Overflow
CVE-2025-22457 is classified under CWE-121 (Stack-based Buffer Overflow), a memory corruption weakness where data written to a stack buffer exceeds its allocated size, overwriting adjacent memory including return addresses and saved registers. In Ivanti's VPN gateway products, a specific input handling routine fails to properly validate the length of incoming data before copying it to a fixed-size stack buffer, allowing a remote attacker to overwrite the return address and redirect execution to attacker-controlled code.
Learn more: CWE-121 — Stack-based Buffer Overflow
CWE-787: Out-of-bounds Write
The vulnerability also falls under CWE-787 (Out-of-bounds Write) as the buffer overflow results in writing data beyond the intended buffer boundary in stack memory, corrupting adjacent data structures and enabling arbitrary code execution.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
CVE-2025-22457 carries a CVSS v3.1 base score of 9.0 (Critical) with changed scope, indicating the vulnerability can affect resources beyond the VPN appliance itself. While attack complexity is rated high (AC:H), the attack requires no privileges (PR:N) and no user interaction (UI:N), and is network-accessible (AV:N). Confidentiality, integrity, and availability are all rated High with changed scope (S:C), because compromising an Ivanti VPN gateway gives an attacker a foothold on the network perimeter with potential access to all internal resources behind the VPN. This includes the ability to intercept VPN traffic, access internal applications, harvest user credentials, deploy persistent implants, and pivot laterally across the enterprise network. The EPSS score of 55.5% at the 98th percentile confirms widespread exploitation. Ransomware operators are known to target this vulnerability, following the pattern of exploiting VPN gateway vulnerabilities as an initial access vector for large-scale ransomware deployments across enterprise networks.
Exploit Maturity
CVE-2025-22457 demonstrates very high exploit maturity with confirmed active exploitation by both nation-state actors and ransomware groups. CISA has added it to the Known Exploited Vulnerabilities catalog with the ransomware association classified as Known and an unusually short 7-day remediation deadline, indicating extreme urgency. The EPSS score of 55.5% at the 98th percentile indicates high probability of exploitation in the wild. Ivanti VPN products have been repeatedly targeted in high-profile exploitation campaigns, with threat actors including UNC5221 and other China-nexus groups historically exploiting Ivanti vulnerabilities within days of disclosure. The stack-based buffer overflow vulnerability class in network-facing VPN appliances represents the highest-value target for advanced threat actors, as it provides both unauthenticated remote access and a strategic network position for further compromise.
Remediation
-
Apply Ivanti patches immediately following the Ivanti security advisory. Update Connect Secure to version 22.7R2.6+, Policy Secure to version 22.7R1.4+, and ZTA Gateways to version 22.8R2.2+. Given the 7-day CISA deadline, this should be treated as an emergency change.
-
Run Ivanti's Integrity Checker Tool (ICT) on all Ivanti appliances before and after patching to detect signs of compromise. Review the results carefully, as sophisticated threat actors may modify system files or install persistent backdoors that survive standard patching.
-
If compromise indicators are detected, perform a factory reset of the Ivanti appliance followed by a clean installation of the patched firmware. Do not simply patch over a compromised system, as advanced persistent threat actors are known to install persistence mechanisms that survive in-place upgrades.
-
Implement network-level monitoring for unusual traffic patterns from Ivanti appliances, including unexpected outbound connections, DNS queries to unfamiliar domains, and internal scanning activity. Deploy intrusion detection signatures specific to Ivanti exploitation techniques.
-
Consider implementing defense-in-depth by placing Ivanti appliances behind additional network controls, implementing certificate-based authentication for VPN access, and deploying endpoint detection on all systems accessible through the VPN to detect lateral movement following potential gateway compromise.
Technical Details
CVE-2025-22457 is a stack-based buffer overflow in Ivanti Connect Secure (before 22.7R2.6), Policy Secure (before 22.7R1.4), and ZTA Gateways (before 22.8R2.2). The CVSS v3.1 vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H indicates a network-accessible, unauthenticated attack with changed scope, meaning successful exploitation compromises not just the appliance but potentially all resources behind it. The vulnerability exists in a network-facing service that processes incoming requests without adequate bounds checking. When a specially crafted request is received, the input data overflows a fixed-size stack buffer, overwriting the saved return address and potentially other stack-based variables. The high attack complexity rating reflects the need to precisely control stack memory layout to achieve reliable code execution, including bypassing potential stack protection mechanisms. However, given the embedded Linux platform and the specific characteristics of the Ivanti firmware environment, attackers with sufficient expertise can achieve reliable exploitation. The buffer overflow provides a direct path from unauthenticated network access to arbitrary code execution on the gateway appliance, which operates at a critical network boundary position.
Frequently Asked Questions
Is CVE-2025-22457 being actively exploited?
Yes. CVE-2025-22457 is under active exploitation by nation-state threat actors and ransomware groups. CISA assigned an unusually short 7-day remediation deadline, and the ransomware association is classified as Known. Ivanti VPN products have been a recurring target for advanced persistent threats.
What products are affected by CVE-2025-22457?
Ivanti Connect Secure versions before 22.7R2.6, Ivanti Policy Secure versions before 22.7R1.4, and Ivanti ZTA Gateways versions before 22.8R2.2 are all affected by this vulnerability.
How do I fix CVE-2025-22457?
Apply Ivanti's security updates immediately: Connect Secure 22.7R2.6+, Policy Secure 22.7R1.4+, ZTA Gateways 22.8R2.2+. Run the Integrity Checker Tool before and after patching. If compromise is suspected, perform a factory reset before applying the patch.
How severe is CVE-2025-22457?
CVE-2025-22457 is rated Critical (CVSS 9.0) with changed scope, meaning it can impact resources beyond the appliance. Its use in ransomware campaigns, nation-state targeting, and 55.5% EPSS score make it one of the most dangerous VPN vulnerabilities currently known.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.