Ivanti Connect Secure / Policy Secure / ZTA Gateways CVE-2025-0282 (unauthenticated stack overflow, remote code execution, exploited as a zero-day, CISA KEV): which versions are fixed and what do CISA's mitigation instructions require?

What it is: CVE-2025-0282 is a stack-based buffer overflow that lets a remote, unauthenticated attacker run code on Ivanti Connect Secure VPN appliances, Ivanti Policy Secure and Ivanti Neurons for ZTA gateways. Ivanti disclosed it on January 8, 2025, together with CVE-2025-0283. Mandiant reported zero-day exploitation starting in mid-December 2024, with attackers deploying malware families on compromised appliances. CISA added it to the Known Exploited Vulnerabilities catalog on 2025-01-08, and in March 2025 updated its mitigation instructions after finding a new malware variant, RESURGE, that could undermine the earlier mitigations. Am I affected: - Ivanti Connect Secure before 22.7R2.5, Ivanti Policy Secure before 22.7R1.2, Ivanti Neurons for ZTA gateways before 22.7R2.3 (per NVD). - Check the version in the appliance's admin console and compare with Ivanti's advisory. Fix (following CISA's instructions): 1. Hunt first: run Ivanti's external Integrity Checker Tool, and hunt on any systems connected, or recently connected, to the appliance. 2. If no compromise is found: for the highest confidence, factory reset the appliance (cloud and virtual appliances from an external known-clean image), apply Ivanti's patch, then keep monitoring the authentication or identity services the appliance could expose and keep auditing privileged accounts. 3. If compromise is found: report to CISA and Ivanti, disconnect the appliance, factory reset it, and isolate it from enterprise resources as far as possible. Revoke and reissue connected or exposed certificates, keys and passwords: reset the admin enable password, stored API keys, and the passwords of local users on the gateway, including service accounts used for authentication server configuration. 4. If domain accounts tied to the appliance were compromised: reset on-premises passwords twice, revoke Kerberos tickets, then revoke tokens for cloud accounts in hybrid setups, and disable cloud-joined devices to revoke their device tokens. Verify: the appliance runs a fixed version installed after a factory reset, the external integrity check is clean, and the rotated credentials and certificates are the only ones that work. Sources: https://www.cisa.gov/cisa-mitigation-instructions-cve-2025-0282 https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day https://nvd.nist.gov/vuln/detail/CVE-2025-0282 https://forums.ivanti.com/s/article/Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-0282-CVE-2025-0283