Untitled attachment

Notices where this attachment appears

1. Embed this notice
   Caitlin Condon (catc0n@infosec.exchange)'s status on Friday, 11-Apr-2025 04:25:10 JST Caitlin Condon

   Full analysis of Ivanti Connect Secure CVE-2025-22457 via @stephenfewer — full RCE, exploitation non-trivial (at least as it stands now).

   We should all be assuming that for any popular or high-profile technology, particularly network edge devices, adversaries have piles of software they're actively reverse engineering and developing complex exploit chains for, regardless of whether vulnerabilities are disclosed publicly as security issues or not. TAs are putting time, resources, and focus into learning the internals of *many* of these systems. If the technology industry broadly — and we ALL live in glass houses here — can't match that investment with expertise and evolution, I'm not sure we can expect the current attack landscape to improve.

   https://attackerkb.com/topics/0ybGQIkHzR/cve-2025-22457/rapid7-analysis