CVE-2025-22457: Critical Stack-Based Buffer Overflow in Ivanti Connect Secure

Overview

CVE-2025-22457 is a critical stack-based buffer overflow vulnerability identified in Ivanti Connect Secure (ICS), Ivanti Policy Secure, and Ivanti ZTA Gateways. This flaw allows remote, unauthenticated attackers to execute arbitrary code on affected systems, posing significant security risks. The vulnerability affects ICS versions prior to 22.7R2.6, Policy Secure versions before 22.7R1.4, and ZTA Gateways versions before 22.8R2.2. ​TechRadar+15Tenable®+15NVD+15SANS Institute+5Rapid7+5NVD+5Ivanti Community+10NVD+10Tenable®+10

Vulnerability Summary

• CVE ID: CVE-2025-22457​

• Severity: Critical (CVSS score: 9.0)​

• Attack Vector: Network​Google Cloud+1CISA+1

• Privileges Required: None​

• User Interaction: None​

• Impact: Allows remote code execution, potentially leading to full system compromise. ​CERT NZ+1SANS Institute+1

Affected Products

How the Exploit Works

The vulnerability stems from a stack-based buffer overflow, which can be exploited by sending specially crafted requests to the affected devices. Successful exploitation allows attackers to execute arbitrary code remotely without authentication. Notably, threat actors have been observed deploying malware families such as TRAILBLAZE (an in-memory dropper) and BUSHFIRE (a passive backdoor) following exploitation. ​Rapid7+9SANS Institute+9CISA+9Truesec+2TechRadar+2Google Cloud+2

Potential Risks

Exploitation of this vulnerability can lead to:​

• Unauthorized remote code execution​NVD+4Google Cloud+4Rapid7+4

• Deployment of persistent malware​

• Potential full system compromise​

• Access to sensitive data​SANS Institute

• Further infiltration into connected networks​

Given the critical nature and active exploitation of this vulnerability, the risks are substantial.​

Mitigation Recommendations

To protect against CVE-2025-22457:

1. Immediate Patching: Update Ivanti Connect Secure to version 22.7R2.6 or later, Ivanti Policy Secure to version 22.7R1.4 or later, and Ivanti ZTA Gateways to version 22.8R2.2 or later. ​Google Cloud+14NVD+14Tenable®+14

2. Integrity Checks: Run Ivanti’s Integrity Checker Tool (ICT) to detect potential compromises. ​CISA+3TechRadar+3CISA+3

3. Factory Reset if Compromised: If ICT indicates a compromise, perform a factory reset on the appliance and reinitialize it with the updated version before returning it to production. ​CISA+3Truesec+3Rapid7+3

4. Monitor Systems: Continuously monitor authentication and identity management services for unusual activity.​CISA+1CISA+1

5. Audit Privileged Accounts: Regularly audit accounts with elevated privileges to ensure no unauthorized access.​

Conclusion

CVE-2025-22457 represents a significant security threat due to its potential for remote code execution without authentication. Organizations using affected Ivanti products should prioritize applying the necessary patches and conducting thorough system integrity checks to mitigate this risk. Proactive measures are essential to safeguard systems against active exploitation by sophisticated threat actors.