Ivanti Connect Secure Vulnerability Allows Remote Code Execution
Ivanti released an advisory detailing multiple vulnerabilities affecting its Connect Secure, Policy Secure, and Secure Access Client products. Some of the flaws allow for RCE and unauthorized data access. The vulnerabilities range from medium to critical severity and impact various versions of Ivanti products. The highest-scoring vulnerability from this security advisory is CVE-2025-22467 with a CVSS score of 9.9. CVE-2025-22467 is a critical stack-based buffer overflow vulnerability in Ivanti Connect Secure that grants the adversary the ability to execute arbitrary code on affected systems. Another critical vulnerability, CVE-2024-38657 (CVSS 9.1), enables an attacker with admin privileges to write arbitrary files, potentially compromising system integrity. Other vulnerabilities include code injection flaws (CVE-2024-10644, CVSS 9.1), arbitrary file read vulnerabilities (CVE-2024-12058), reflected cross-site scripting (XSS) vulnerabilities (CVE-2024-13830), and issues related to hardcoded keys and cleartext storage of sensitive information (CVE-2024-13842, CVE-2024-13843). Ivanti has addressed these vulnerabilities in the latest versions of their products:
Security Officer Comments:
The recent disclosure of multiple vulnerabilities in Ivanti's Connect Secure, Policy Secure, and Secure Access Client products is a significant security event that demands immediate attention. Ivanti Connect Secure is a well-known SSL VPN solution used by many organizations. Therefore, these flaws are incentivized targets for exploitation by threat actors to gain complete control of a system. Remote code execution vulnerabilities grant the attacker a slew of capabilities, underscoring the severity of these Ivanti vulnerabilities. CVE-2025-22467 allows an authenticated remote attacker to execute arbitrary code. While authentication is required, the potential for exploitation remains high, especially in environments where compromised credentials or weak authentication mechanisms are present. Ivanti's prompt release of patches is commendable. However, the window of vulnerability between disclosure and patching is a critical period. Organizations using these Ivanti products must prioritize patching their systems immediately. The potential for widespread impact necessitates a swift and decisive response from all affected organizations.
Suggested Corrections:
Customers are advised to update to these versions as soon as possible. The company provides access to the updated software through its download portal (login required). While Ivanti is not currently aware of any active exploitation of these vulnerabilities, the potential impact underscores the urgency of applying the available updates.
Link(s):
https://securityonline.info/cve-2025-22467-cvss-9-9-ivanti-connect-secure-vulnerability-allows-remote-code-execution/