April 7, 2025
CISA published a cybersecurity alert on Friday to address the vulnerabilities mentioned below in Ivanti Connect Secure, Policy Secure, and ZTA Gateways (CVE-2025-22457), and has added them to its Known Exploited Vulnerabilities catalog. CISA's alert includes additional guidance, resources, and actions users and administrators should follow to help mitigate these vulnerabilities.
April 3, 2025
Summary: On April 3, 2025, Ivanti released a security advisory regarding the active exploitation of a critical security flaw affecting vulnerable Ivanti Connect Secure, Pulse Connect Secure, Policy Secure, and ZTA Gateway products.
The vulnerability, tracked as CVE-2025-22457, has a CVSS critical score of 9.0 and is a stack-based buffer overflow flaw impacting Ivanti Connect Secure (22.7R2.5 and prior), Pulse Connect Secure (9.1R18.9 and prior) which reached end-of-support as of December 31, 2024, Ivanti Policy Secure (22.7R1.3 and prior), and ZTA Gateways (22.8R2 and prior).
Analyst Note: As Ivanti vulnerabilities have impacted member utilities previously, WaterISAC urges members to upgrade affected Ivanti products to remediate this vulnerability as soon as possible. Successful exploitation of the security flaw allows remote unauthenticated threat actors to gain remote code execution capabilities on vulnerable instances. According to Mandiant and Ivanti, evidence of active exploitation in the wild has been observed against Ivanti Connect Secure 9.x (end of life) and 22.7R2.5 and earlier versions. The first sighting of active exploitation occurred in mid-March 2025, following a successful compromise. Two newly identified malware families were observed, TRAILBLAZE and BRUSHFIRE, which are identified as an in-memory dropper and a passive backdoor, respectively.
Original Source: https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US
Additional Reading:
Related WaterISAC PIRs: 6, 7, 8, 12
