CVE-2025-0282: Ivanti Connect Secure -- Stack Overflow Zero-Day RCE

Background

Ivanti Connect Secure (formerly Pulse Secure) has a long history of critical zero-day vulnerabilities exploited by sophisticated threat actors, and CVE-2025-0282 fits that history squarely. Disclosed in January 2025 and exploited before the patch shipped, it was used in campaigns attributed to Chinese state-sponsored actors.

Mandiant found active exploitation of CVE-2025-0282 during incident response work and reported it to Ivanti, who released a patch on January 8, 2025. The attack vector, impact, and post-exploitation behaviour closely mirror the January 2024 CVE-2023-46805/CVE-2024-21887 campaign by the same or affiliated threat actors.

Technical Mechanism

CVE-2025-0282 is a stack-based buffer overflow (CWE-121) in the pre-authentication component of Ivanti Connect Secure. Stack buffer overflows happen when data copied into a stack-allocated buffer exceeds its capacity, overwriting adjacent stack memory — including saved return addresses and function pointers.

The vulnerable component processes network requests before any authentication occurs. A specially crafted request causes an oversized data copy onto the stack:

// Conceptual vulnerable pattern
void process_connection(const char *request_data, size_t request_len) {
    char buffer[FIXED_SIZE];  // Stack-allocated buffer
    
    // Dangerous: copies up to request_len bytes without checking FIXED_SIZE
    memcpy(buffer, request_data, request_len);  // Stack overflow if request_len > FIXED_SIZE
    
    process_parsed_request(buffer);
}

Exploit development for stack overflows on modern systems requires bypassing:

• Stack canaries: Detect stack corruption; bypassed via information leak or by targeting canary-exempt code paths
• NX/DEP: Non-executable stack; bypassed using Return-Oriented Programming (ROP) — chaining existing executable code gadgets
• ASLR: Address Space Layout Randomization; bypassed via information leak from a separate vulnerability or by targeting code segments with predictable addresses

Ivanti appliances run a custom Linux environment. Threat actors targeting these appliances have developed reliable exploits despite these mitigations, drawing on prior public analysis of Ivanti’s codebase.

The exploit requires sending a crafted packet to the Ivanti Connect Secure VPN service port (443), achieving code execution as root in the VPN daemon process.

Real-World Exploitation Evidence

Mandiant’s analysis documented post-exploitation activity in some depth:

• SPAWN malware ecosystem: Mandiant documented a multi-component framework dubbed SPAWN, deployed post-exploitation. Components included:
  • SPAWNANT: An installer designed to maintain malware persistence across device upgrades
  • SPAWNMOLE: A tunneller that creates encrypted tunnels through the appliance for C2 communications
  • SPAWNSNAIL: An SSH backdoor on the appliance’s internal SSH service, providing persistent access
• Attribution: Mandiant attributed exploitation to UNC5337, assessed as linked to UNC5221 — the same or affiliated Chinese state-sponsored group behind the January 2024 campaign.
• Targeted scope: Initial exploitation was narrowly targeted at specific government, defence, and critical infrastructure organisations rather than opportunistic mass scanning.
• Persistence through upgrades: SPAWN was built to survive firmware upgrades, reflecting deep knowledge of the product and an intent for long-term access.

Impact Assessment

Root access on a perimeter VPN appliance provides:

• Credential interception: All VPN authentication traffic passes through the appliance; credentials can be harvested.
• Persistent network access: The compromised appliance gives a permanent foothold inside the target network that is hard to detect and remove.
• Traffic inspection: TLS termination can be manipulated to expose encrypted traffic contents.
• Lateral movement: The appliance holds trusted internal network access, enabling reconnaissance and attacks against internal systems.
• Survival through remediation: SPAWN’s ability to persist through firmware upgrades means basic remediation steps may be insufficient.

Affected Versions

Remediation Steps

1. Apply patches: Update to Connect Secure 22.7R2.5 or later. Policy Secure and ZTA Gateways have separate fix versions.

2. Run Ivanti’s Integrity Checker Tool (ICT) first: Before patching, run the ICT to detect the SPAWN malware ecosystem:

   • External ICT (cloud-based): More thorough detection
   • Local ICT: Maintenance > Diagnostics > Integrity Check

3. Factory reset before patching: Ivanti and CISA recommend performing a factory reset before applying the patch if compromise is suspected — the SPAWN malware may not be fully removed by patching alone.

4. Monitor for SPAWN persistence post-patch: Even after factory reset and patching, monitor for signs of SPAWNANT reinstallation via network traffic to C2 infrastructure.

5. Treat all credentials as compromised: Rotate all credentials that may have been processed through the VPN appliance.

6. Review CISA KEV supplemental guidance: CISA issued specific guidance on responding to Ivanti Connect Secure compromises given the persistence mechanisms involved.

Detection Guidance

Log sources:

• Ivanti Connect Secure system log: Maintenance > Diagnostics > System Logs
• Integrity Checker Tool output
• Network monitoring for unusual outbound connections from VPN appliance IP

SPAWN malware indicators:

• Modifications to /home/webserver/htdocs/dana-na/ or similar web directories
• Unusual SSH processes or listening on unexpected ports
• Outbound TCP connections from appliance IP to non-Ivanti IPs on ports 443, 4444, or 8443
• ICT reports of failed file hash verification

Suricata signature:

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"Ivanti Connect Secure CVE-2025-0282 SPAWN C2 Beacon"; flow:established,to_server; dsize:32; content:"|00 00 00|"; depth:3; threshold:type both, track by_src, count 3, seconds 30; sid:9002502; rev:1;)

Timeline

References

• NVD — CVE-2025-0282
• CISA KEV — CVE-2025-0282
• Ivanti Security Advisory — CVE-2025-0282