{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-0282/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-0282/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-0282/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-0282/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-0282/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-0282"},"sightings":{"href":"/api/v1/sightings/cve-2025-0282"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-0282.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-0282\n\ninfo:\n  name: Ivanti Connect Secure - Stack-based Buffer Overflow\n  author: ritikchaddha\n  severity: critical\n  description: |\n    Ivanti Connect Secure < 22.7R2.5, Ivanti Policy Secure < 22.7R1.2, and Ivanti Neurons for ZTA gateways < 22.7R2.3 contain a stack-based buffer overflow in the clientCapabilities parameter handling. This vulnerability allows remote unauthenticated attackers to execute arbitrary code through IF-T TLS requests.\n  impact: |\n    Unauthenticated attackers can exploit a stack-based buffer overflow to execute arbitrary code remotely on Ivanti Connect Secure devices, potentially compromising VPN infrastructure and accessing all connected networks.\n  remediation: |\n    Upgrade to Ivanti Connect Secure version 22.7R2.5, Ivanti Policy Secure version 22.7R1.2, or Ivanti Neurons for ZTA version 22.7R2.3 or later.\n  reference:\n    - https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283\n    - https://labs.watchtowr.com/exploitation-walkthrough-and-techniques-ivanti-connect-secure-rce-cve-2025-0282/\n    - https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-0282\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.0\n    cve-id: CVE-2025-0282\n    cwe-id: CWE-121,CWE-787\n    epss-score: 0.99979\n    epss-percentile: 0.9998\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: ivanti\n    product: connect_secure\n    shodan-query: http.title:\"ivanti connect secure\"\n  tags: cve,cve2025,ivanti,rce,buffer-overflow,passive,kev,vkev,vuln\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/dana-na/auth/url_default/welcome.cgi\"\n      - \"{{BaseURL}}/dana-na/auth/url_6/welcome.cgi\"\n      - \"{{BaseURL}}/dana/home/index.cgi\"\n\n    stop-at-first-match: true\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"Ivanti\"\n          - \"Connect Secure\"\n          - \"Policy Secure\"\n          - \"Neurons for ZTA\"\n        condition: or\n\n      - type: dsl\n        dsl:\n          - \"compare_versions(vulnerable_version, '< 22.7R2.5')\"\n\n    extractors:\n      - type: regex\n        name: vulnerable_version\n        part: body\n        group: 1\n        regex:\n          - '(?i)(22\\.[0-6][Rr][0-9]+(?:\\.[0-9]+)?)'  # All 22.0-22.6 versions vulnerable\n          - '(?i)(22\\.7[Rr][0-1](?:\\.[0-1])?)'        # Policy Secure < 22.7R1.2\n          - '(?i)(22\\.7[Rr]2(?:\\.[0-4])?)'            # Connect Secure < 22.7R2.5, ZTA < 22.7R2.3\n\n      - type: kval\n        kval:\n          - version\n# digest: 4a0a004730450220411986123b881bc6ee53fb95d4b452b9ca959613af0c4e2ebc8a67501f071091022100a5106952e62b65e80e0aa9ff372059bc3186b2ed074c49e023d8df01f026298b:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-0282"}