certfr_avis - certfr-2025-avi-0273

CERTFR-2025-AVI-0273

Vulnerability from certfr_avis

Une vulnérabilité a été découverte dans les produits Ivanti. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Ivanti indique que la vulnérabilité CVE-2025-22457 est activement exploitée.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

L'éditeur indique que les correctifs seront disponibles le 19 avril 2025 pour Zero Trust Access Gateways et le 21 avril 2025 pour Ivanti Policy Secure. L'éditeur indique que les Pulse Connect Secure en versions 9.1x sont en fin de vie depuis le 31 décembre 2024. Les utilisateurs peuvent contacter Ivanti pour migrer vers une version à jour.

Impacted products

Vendor	Product	Description
Ivanti	Pulse Connect Secure	Pulse Connect Secure versions antérieures à 22.7R2.6
Ivanti	Zero Trust Access gateways	Zero Trust Access Gateways versions antérieures à 22.8R2.2
Ivanti	Policy Secure (IPS)	Ivanti Policy Secure (IPS) versions antérieures à 22.7R1.4
Ivanti	Connect Secure (ICS)	Ivanti Connect Secure (ICS) versions antérieures à 22.7R2.6 (correctif publié le 11 février 2025)

References

Title

Publication Time

Tags

Bulletin de sécurité Ivanti April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457	2025-04-03	vendor-advisory
Avis CERT-FR CERTFR-2025-AVI-0121 du 12 février 2025	-	other
Bulletin de sécurité Ivanti du 11 février 2025	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Pulse Connect Secure versions ant\u00e9rieures \u00e0 22.7R2.6",
      "product": {
        "name": "Pulse Connect Secure",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Zero Trust Access Gateways versions ant\u00e9rieures \u00e0 22.8R2.2",
      "product": {
        "name": "Zero Trust Access gateways",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Ivanti Policy Secure (IPS) versions ant\u00e9rieures \u00e0 22.7R1.4",
      "product": {
        "name": "Policy Secure (IPS)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    },
    {
      "description": "Ivanti Connect Secure (ICS) versions ant\u00e9rieures \u00e0 22.7R2.6 (correctif publi\u00e9 le 11 f\u00e9vrier 2025)",
      "product": {
        "name": "Connect Secure (ICS)",
        "vendor": {
          "name": "Ivanti",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "L\u0027\u00e9diteur indique que les correctifs seront disponibles le 19 avril 2025 pour Zero Trust Access Gateways et le 21 avril 2025 pour Ivanti Policy Secure.\nL\u0027\u00e9diteur indique que les Pulse Connect Secure en versions 9.1x sont en fin de vie depuis le 31 d\u00e9cembre 2024. Les utilisateurs peuvent contacter Ivanti pour migrer vers une version \u00e0 jour.",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-22457",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-22457"
    }
  ],
  "initial_release_date": "2025-04-03T00:00:00",
  "last_revision_date": "2025-04-03T00:00:00",
  "links": [
    {
      "title": "Avis CERT-FR CERTFR-2025-AVI-0121 du 12 f\u00e9vrier 2025",
      "url": "https://www.cert.ssi.gouv.fr/avis/CERTFR-2025-AVI-0121/"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ivanti du 11 f\u00e9vrier 2025",
      "url": "https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US"
    }
  ],
  "reference": "CERTFR-2025-AVI-0273",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-04-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans les produits Ivanti. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n\nIvanti indique que la vuln\u00e9rabilit\u00e9 CVE-2025-22457 est activement exploit\u00e9e.",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Ivanti",
  "vendor_advisories": [
    {
      "published_at": "2025-04-03",
      "title": "Bulletin de s\u00e9curit\u00e9 Ivanti April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457",
      "url": "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457"
    }
  ]
}

CVE-2025-22457 (GCVE-0-2025-22457)

Vulnerability from cvelistv5

Published

2025-04-03 15:20

Modified

2025-07-30 01:36

Severity ?

9.0 (Critical) - CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-121 - Stack-based Buffer Overflow

Summary

A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.

References

URL

Tags

https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457

Impacted products

Vendor

Product

Version

Ivanti

Connect Secure

Patch: 22.7R2.6

	Ivanti	Policy Secure	Patch: 22.7R1.4
	Ivanti	Neurons for ZTA gateways	Patch: 22.8R2.2

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-22457",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-04-24T03:55:18.340082Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-04-04",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-22457"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-07-30T01:36:15.776Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "timeline": [
          {
            "lang": "en",
            "time": "2025-04-04T00:00:00+00:00",
            "value": "CVE-2025-22457 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "affected",
          "product": "Connect Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R2.6",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Policy Secure",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.7R1.4",
              "versionType": "custom"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Neurons for ZTA gateways",
          "vendor": "Ivanti",
          "versions": [
            {
              "status": "unaffected",
              "version": "22.8R2.2",
              "versionType": "custom"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.\u003c/span\u003e"
            }
          ],
          "value": "A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-100",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-100 Overflow Buffers"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 9,
            "baseSeverity": "CRITICAL",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-121",
              "description": "CWE-121 Stack-based Buffer Overflow",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-03T15:20:23.628Z",
        "orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
        "shortName": "ivanti"
      },
      "references": [
        {
          "url": "https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
    "assignerShortName": "ivanti",
    "cveId": "CVE-2025-22457",
    "datePublished": "2025-04-03T15:20:23.628Z",
    "dateReserved": "2025-01-07T02:19:22.796Z",
    "dateUpdated": "2025-07-30T01:36:15.776Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2025-AVI-0273

Vulnerability from certfr_avis

Solutions

CVE-2025-22457 (GCVE-0-2025-22457)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature