Fixed Intel

CISA Known Exploited Vulnerability

This vulnerability is actively exploited in the wild and listed in the CISA Known Exploited Vulnerabilities catalog.

Remediation Deadline: Jan 15, 2025

CVE-2025-0282

High
EPSS 94.1%CISA KEVRansomware
Ivanti/Connect Secure, Policy Secure, and ZTA Gateways

Description

Ivanti Connect Secure, Policy Secure, and ZTA Gateways contain a stack-based buffer overflow which can lead to unauthenticated remote code execution.

EPSS — Exploit Probability

94.1%

Higher than 99.9% of all CVEs

Required Action

CISA Mitigation Instructions: https://www.cisa.gov/cisa-mitigation-instructions-CVE-2025-0282 Additional References: https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283 ; https://nvd.nist.gov/vuln/detail/CVE-2025-0282

Risk Assessment

CRITICAL
In CISA KEV
High EPSS
Ransomware

Details

Severity
High
EPSS
94.1%
CISA KEV
Yes
Ransomware
Known
Articles
0

Timeline

Published

Jan 8, 2025

Added to KEV

Jan 8, 2025

Remediation Due

Jan 15, 2025

Affected Product

Ivanti

Connect Secure, Policy Secure, and ZTA Gateways

View all Ivanti CVEs