CVE-2025-0282 — Ivanti Connect Secure / Policy Secure / ZTA Gateways Stack-Based Buffer Overflow RCE

CVSS 9.0 — CRITICAL | Actively Exploited Zero-Day | Discovered January 2025

Overview

CVE-2025-0282 is a stack-based buffer overflow vulnerability (CWE-121 / CWE-787) in the IFT/TLS handling component of Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti ZTA Gateways. The flaw allows an unauthenticated, remote attacker to achieve arbitrary code execution on the target appliance with root privileges.

The vulnerability was disclosed on January 8, 2025 after being observed in active exploitation as a zero-day. It was attributed to the China-nexus threat actor tracked as UNC5337 by Mandiant. CISA added this CVE to its Known Exploited Vulnerabilities (KEV) catalog within 72 hours of public disclosure.

Technical Details

Root Cause

The vulnerability resides in the IFT (Internal Forwarding Table) / TLS packet processing path of the appliance's HTTPS management interface. When parsing malformed TLS handshake messages or specially crafted IFT frames, the code copies attacker-controlled data into a fixed-size stack buffer without proper bounds checking:

memcpy(stack_buffer, attacker_data, attacker_controlled_length);  // no length check

Because the destination buffer resides on the stack, an oversized payload overwrites:

• Local variables — can alter program logic
• Saved return address (RIP/RA) — enables ROP or direct code execution
• SEH chain (Windows-based versions) — enables SEH overwrite

Attack Vector

Exploitation Characteristics

• Full chain does not require authentication
• Exploitation occurs at the TLS handshake stage, before application-layer authentication
• Public PoC code leverages a large physical frame size field (>65535 bytes) in a crafted TLS record to overflow a 1024-byte stack buffer
• Successful exploitation provides a root shell on the appliance
• Post-exploitation activity by UNC5337 included credential dumping, tunnel installation, and lateral movement

Affected Versions

Note: Ivanti has confirmed that the 22.6 release line is also vulnerable. Customers still on ICS 9.x or 22.4 are equally exposed.

Detection Indicators

• Unexpected TLS handshake sizes in HTTPS management interface logs
• Processes crashing with access violations on sslvpn or dsaccess services
• Unscheduled appliance reboots
• Presence of files such as /tmp/*.py, .sslvpn_config_upload, or unexpected cron entries
• Outbound connections from the appliance to IPs associated with UNC5337 infrastructure

Reproduction Steps

Prerequisites

• Python 3.8+
• A target Ivanti appliance (authorized test environment only)
• Network access to the HTTPS management interface (port 8443 by default)
• scapy, socket, and ssl Python modules

Setup

1. Clone this repository:

   root@kitploit:~

   git clone https://github.com/your-org/cve-2025-0282-reproduction
   cd cve-2025-0282-reproduction
   

2. Install dependencies:

   root@kitploit:~

   pip install -r requirements.txt
   

   (Requirements: scapy, argparse, socket — socket is stdlib)

Execution

1. Run the PoC against your target:

   root@kitploit:~

   python exploit.py --target 192.168.1.100 --port 8443
   

2. To specify a custom payload size:

   root@kitploit:~

   python exploit.py --target 192.168.1.100 --port 8443 --payload-size 4096
   

3. Enable debug output:

   root@kitploit:~

   python exploit.py --target 192.168.1.100 --port 8443 --verbose
   

What the PoC Does

1. Opens a TCP connection to the target's HTTPS management interface
2. Sends a standard TLS ClientHello
3. On receiving the ServerHello, the PoC injects a malformed TLS record with an oversized IFT frame size field
4. This malformed record triggers the memcpy into a 1024-byte stack buffer without bounds checking
5. The overflow corrupts the stack, providing a proof-of-concept crash (segmentation fault or access violation)
6. In a full exploit, this crash would be replaced with a ROP chain that executes arbitrary code

Important: The code provided is for educational and authorized testing only. It demonstrates the buffer overflow condition and will cause a denial of service (crash) on unpatched targets. Running this against systems you do not own or have written permission to test is illegal.

PoC Code

See exploit.py in this repository.

The script accepts the following arguments:

usage: exploit.py [-h] --target TARGET [--port PORT] [--payload-size PAYLOAD_SIZE] [--verbose]

CVE-2025-0282 Ivanti Stack Buffer Overflow Reproduction PoC

options:
  -h, --help            show this help message and exit
  --target TARGET       Target Ivanti appliance IP or hostname
  --port PORT           Target port (default: 8443)
  --payload-size PAYLOAD_SIZE
                        Size of overflow payload in bytes (default: 4096)
  --verbose             Enable verbose/debug output

Mitigation

Workarounds (if patching is delayed)

• Deploy a WAF/IPS with a TLS record-size check rule in front of the management interface
• Disable the management interface on external-facing network interfaces
• Use Ivanti's External Integrity Checker (IC) tool to verify appliance integrity

References

• NIST NVD CVE-2025-0282
• CISA KEV CVE-2025-0282
• Mandiant / UNC5337 Analysis
• Ivanti Security Advisory
• ATT&CK: Exploit Public-Facing Application (T1190)
• CWE-121: Stack-based Buffer Overflow
• CWE-787: Out-of-bounds Write

Disclaimer

This repository is provided for authorized security research and educational purposes only. The authors are not responsible for any misuse of this code. Unauthorized exploitation of CVE-2025-0282 is illegal and unethical. Always obtain explicit written permission before testing any system.