Threat Brief: CVE-2025-0282 and CVE-2025-0283 (Updated March 11)
Summary: Ivanti released an advisory on Jan. 8, 2025 for CVE-2025-0282, a stack-based buffer overflow in Connect Secure before 22.7R2.5, Policy Secure before 22.7R1.2 and Neurons for ZTA gateways before 22.7R2.3 that lets an unauthenticated remote attacker achieve code execution (CVSS 9.0), and CVE-2025-0283, a local privilege-escalation overflow in the same products (CVSS 7.0). Unit 42 tracked exploitation as cluster CL-UNK-0979, with telemetry pointing to a late-December 2024 zero-day exploit on a public-facing Connect Secure appliance, followed by a custom Perl credential harvester (ldap.pl), RDP lateral movement, MSBuild.exe compiling a memory dumper (package.dll), log deletion, and SPAWNMOLE, SPAWNSNAIL and SPAWNSLOTH for persistence.
What you should know: These appliances sit at the network edge, so a single unauthenticated request against an unpatched Connect Secure box can hand an attacker a foothold inside, and the actor here deleted logs and emptied /var/cores to erase the trail. Watchtowr published a proof of concept on January 16, which lowers the bar for anyone who has not yet applied Ivanti's patch.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2025-0282CVE-2025-0283
- Related
- CVE-2025-0282: Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow Vulnerability Known Exploited Vulnerabilities · Jan 08, 2025China-Linked Hackers Exploited Beyond Trust Zero-Day to Take Over Remote Support Servers Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026