Solution Ivanti Connect Secure: apply version 22.7R2.6 released Feb. 2025. If customers run into any issue while applying this version, please reach out to Ivanti Support for assistance. If your ICT result shows signs of compromise, you should perform a factory reset on the appliance and then put the appliance back into production using version 22.7R2.6.

Notices where this attachment appears

1. Embed this notice
   Will Dormann (wdormann@infosec.exchange)'s status on Friday, 04-Apr-2025 03:26:04 JST Will Dormann

   Ivanti CVE-2025-22457 is being exploited ITW.
   https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457

   Per Mandiant:

   We assess it is likely the threat actor studied the patch for the vulnerability in ICS 22.7R2.6 and uncovered through a complicated process, it was possible to exploit 22.7R2.5 and earlier to achieve remote code execution.

   Gee, who could have imagined that attackers are looking at patches? 🤔

   1) This apparently was silently fixed for ICS in 22.7R2.6, as the fix for this was released in February. Per Ivanti, the buffer overflow was considered a "product bug" at that time, as opposed to a vulnerability. Ivanti Policy Secure and ZTA gateways are expected to receive a patch in late April.

   2) The advisory still conveys the magical thinking if if your device shows signs of compromise, then you should perform a "factory reset." This is magical in that the ICT won't catch a compromise nor will the "factory reset" reset to factory condition if the attacker is bothering to try.

   While Mandiant also parrots the magical thinking of running the ICT tool, which I guess is the best advice if you're not going to throw the device in the trash since there isn't an official integrity checking tool that is sound, they do throw out a tidbit of:

   ... and conduct anomaly detection of client TLS certificates presented to the appliance.

   Bets on whether CVE-2025-22457 is an overflow in the handling of a field in a client-provided certificate? 😂