CVE-2025-0282

Name of the Vulnerable Software and Affected Versions Ivanti Connect Secure versions prior to 22.7R2.5 Ivanti Policy Secure versions prior to 22.7R1.2 Ivanti Neurons for ZTA gateways versions prior to 22.7R2.3

Description A stack-based buffer overflow and out-of-bounds memory read exist in the affected software. This allows a remote unauthenticated attacker to achieve remote code execution and elevate privileges. Real-world exploitation has been observed since mid-December 2024, targeting financial institutions and government agencies. Attackers have utilized an ELF-based remote-access Trojan (RAT) known as DslogdRAT, which employs a configuration setup routine init config() to decrypt settings using an XOR cipher and a child() function to maintain persistence through continuous forking. The exploitation process involves disabling SELinux, preventing syslog forwarding, remounting the drive as read-write, deploying web shells, and manipulating the Ivanti Integrity Checker Tool (ICT) manifest to bypass integrity checks. Additionally, the PHASEJAM malware has been used to display fake update progress bars to deceive administrators while blocking legitimate system updates.

Recommendations Update Ivanti Connect Secure to version 22.7R2.5 or later. Update Ivanti Policy Secure to version 22.7R1.2 or later. Update Ivanti Neurons for ZTA gateways to version 22.7R2.3 or later. Run the external Ivanti ICT tool to verify system integrity.