CVE-2025-0282: the Ivanti VPN zero-day, and its sequel

If you manage remote access for a living, Ivanti Connect Secure has probably cost you a weekend at some point in the last three years. The latest entry is CVE-2025-0282, an unauthenticated stack-based buffer overflow in Connect Secure, Policy Secure, and Neurons for ZTA gateways that Mandiant caught being exploited as a zero-day starting in mid-December 2024, weeks before Ivanti shipped a fix (Google Cloud / Mandiant). CISA added it to the Known Exploited Vulnerabilities catalog and gave federal agencies until January 15 to patch (CISA KEV). It’s the third major Ivanti edge-device RCE chain in two years, and that pattern is the actual story here.

Root cause

CVE-2025-0282 is a classic memory-safety bug: a stack-based buffer overflow (CWE-121) in a web-facing component of Connect Secure that a remote, unauthenticated attacker can trigger with a crafted request, landing arbitrary code execution on the appliance with no credentials and no user interaction (Rapid7). It carries a CVSS base score of 9.0 — full compromise, network attack vector, no privileges required.

This isn’t Ivanti’s first appliance-RCE rodeo. A year earlier it was CVE-2023-46805 (an auth bypass) chained with CVE-2024-21887 (a command injection) to get the same outcome on the same product line (CISA). The underlying story repeats: Connect Secure is a Linux-based appliance running a web application stack that’s directly exposed to the internet by design — that’s the whole point of a VPN gateway — and a memory-corruption or auth-logic bug in that stack turns “reachable on 443” straight into root on the box. There’s no perimeter behind the perimeter device.

Blast radius

Mandiant’s incident response found a genuinely elaborate malware ecosystem dropped on compromised appliances, tracked as the SPAWN family: SPAWNANT (the installer/persistence mechanism), SPAWNMOLE (a tunneler for pivoting into the internal network), SPAWNSNAIL (an SSH backdoor), and SPAWNSLOTH (a log-tampering tool to blind forensic analysis) — plus two newly observed tools, the PHASEJAM dropper and DRYHOOK credential harvester (Google Cloud / Mandiant). Most notably, SPAWNANT was built specifically to tamper with Ivanti’s own Integrity Checker Tool manifest, so the appliance would report clean to the exact tool defenders were told to trust.

Mandiant attributes the activity, with medium confidence, to UNC5337 — believed to be part of UNC5221, the same China-nexus espionage cluster behind the 2023/2024 Ivanti chain — going after VPN gateways specifically because they sit at the network edge with credentials and session state flowing through them and, historically, no EDR agent watching what runs on them (The Record). At the time of disclosure, tens of thousands of Connect Secure instances were sitting exposed to the internet, and exploitation had already been underway for roughly a month before the public advisory (CyberSecurityNews). And the pattern didn’t stop there: three months later, Ivanti disclosed CVE-2025-22457, another unauthenticated stack-based buffer overflow in the same product line — initially misjudged as a low-severity denial-of-service bug until Mandiant showed it was remotely exploitable — and again observed exploited in the wild by a suspected China-nexus actor before agencies could patch (Google Cloud / Mandiant).

Remediation

Patched builds for CVE-2025-0282 have been available since January 8, 2025: Connect Secure 22.7R2.5, Policy Secure 22.7R1.2, and Neurons for ZTA gateways 22.7R2.3 (Ivanti advisory). If you’re still behind those versions, that’s the first move, no exceptions.

But given that SPAWNANT was purpose-built to falsify the Integrity Checker Tool’s output, a clean ICT scan on an unpatched or recently patched device isn’t proof of a clean appliance. Run both the internal and external ICT, but treat it as one signal among several, not a verdict — cross-reference against Ivanti’s published indicators of compromise, check for unexpected outbound tunnels or SSH listeners, and if you have any reason to believe a device was exposed during the exploitation window, the safer path is a factory reset and clean rebuild from a patched image rather than trusting an in-place upgrade to have removed a persistence mechanism designed to survive exactly that. Rotate every credential and certificate that ever transited the appliance — VPN gateways see user passwords, session tokens, and often service-account secrets, all of which should be considered burned if compromise can’t be ruled out.

The bigger lesson

Three major RCE chains on the same Ivanti product line in under two years, each exploited as a zero-day before a patch existed, each attributed to state-nexus actors going straight for the edge — this isn’t bad luck, it’s a target selection. Edge appliances are internet-facing by requirement, run vendor firmware most security teams can’t instrument the way they’d instrument a server, and sit exactly where credentials and network access converge. If you operate any VPN gateway, firewall, or SSL-VPN appliance — Ivanti or otherwise — the operational question isn’t “are we patched” as a one-time checkbox, it’s whether you have a standing plan for zero-day exploitation on a box you can’t put an agent on: network segmentation around the appliance, egress monitoring for exactly the kind of tunneling SPAWNMOLE does, and a rebuild-from-clean playbook you’ve actually rehearsed before you need it at 2am.