PoC for CVE-2025-0282

Remote Unauthenticated Stack Buffer Overflow in Ivanti Products

Overview

This proof-of-concept demonstrates exploitation of CVE-2025-0282, a critical vulnerability affecting:

• Ivanti Connect Secure
• Ivanti Policy Secure
• Ivanti Neurons for ZTA gateways

Based on watchTowr's research, this PoC uses a ROP chain targeting Ivanti Connect Secure 22.7r2.4 specifically. Other versions require custom ROP chain development.

The payload creates a new privileged admin account with:

• Username: admin
• Password: password
• Root-level privileges (UID 0)

Prerequisites

• Python 3.x
• Required packages: requests, pyopenssl
• Vulnerable Ivanti system (version 22.7r2.4)

Usage