CVE-2025-5456: Ivanti Connect Secure DoS Vulnerability

CVE-2025-5456 Overview

A buffer over-read vulnerability (CWE-125) has been identified in multiple Ivanti secure access products. This out-of-bounds read vulnerability allows a remote unauthenticated attacker to read memory beyond the bounds of an allocated buffer, potentially leading to a denial of service condition. The vulnerability affects critical network security infrastructure components including VPN gateways and zero trust access solutions.

Critical Impact

Remote unauthenticated attackers can exploit this vulnerability to cause denial of service on affected Ivanti network security appliances, potentially disrupting secure remote access for entire organizations.

Affected Products

• Ivanti Connect Secure before version 22.7R2.8 or 22.8R2
• Ivanti Policy Secure before version 22.7R1.5
• Ivanti ZTA Gateway before version 2.8R2.3-723
• Ivanti Neurons for Secure Access before version 22.8R1.4

Discovery Timeline

• August 2, 2025 - Fix deployed for Ivanti Neurons for Secure Access
• August 12, 2025 - CVE-2025-5456 published to NVD
• September 23, 2025 - Last updated in NVD database

Technical Details for CVE-2025-5456

Vulnerability Analysis

This vulnerability is classified as CWE-125 (Out-of-bounds Read), commonly known as a buffer over-read. Buffer over-read vulnerabilities occur when software reads data past the end of an intended buffer, which can result in the exposure of sensitive information or cause the application to crash.

In this case, the vulnerability exists in the network-facing components of Ivanti's secure access products. The flaw can be triggered remotely without authentication, making it accessible to any attacker who can reach the affected services over the network. The primary impact is availability, as exploitation leads to denial of service conditions that can disrupt VPN connectivity and secure access services for an organization's users.

Root Cause

The root cause is improper bounds checking when reading data from a buffer. When processing certain network requests, the affected Ivanti components fail to properly validate the boundaries of memory read operations. This allows an attacker to craft malicious requests that cause the application to read beyond the allocated buffer, triggering a crash or service disruption.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted requests to the affected Ivanti services over the network. Since these are perimeter security appliances designed to be internet-facing, they present an attractive target for remote attackers.

The exploitation does not require any privileges, making this vulnerability accessible to opportunistic attackers scanning for vulnerable Ivanti installations. While the vulnerability does not directly enable data exfiltration or code execution, the denial of service impact can be significant for organizations relying on these products for secure remote access.

Detection Methods for CVE-2025-5456

Indicators of Compromise

• Unexpected service crashes or restarts of Ivanti Connect Secure, Policy Secure, or ZTA Gateway appliances
• Anomalous network traffic patterns targeting Ivanti services with malformed or unusual request structures
• Log entries indicating memory access violations or segmentation faults in Ivanti application logs
• Increased crash dump generation on affected appliances

Detection Strategies

• Monitor Ivanti appliance health dashboards for unexpected service interruptions or restart events
• Implement network intrusion detection rules to identify exploit attempts targeting Ivanti secure access products
• Review system logs for patterns consistent with denial of service attacks against VPN infrastructure
• Correlate multiple rapid service restarts with incoming network traffic to identify potential exploitation

Monitoring Recommendations

• Enable verbose logging on Ivanti appliances to capture detailed request information for forensic analysis
• Configure alerting for service availability on all affected Ivanti products
• Monitor network traffic flows to Ivanti appliances for anomalous volume or pattern changes
• Implement SentinelOne Singularity platform for endpoint detection and response capabilities on systems accessing Ivanti services

How to Mitigate CVE-2025-5456

Immediate Actions Required

• Upgrade Ivanti Connect Secure to version 22.7R2.8 or 22.8R2 or later immediately
• Upgrade Ivanti Policy Secure to version 22.7R1.5 or later
• Upgrade Ivanti ZTA Gateway to version 2.8R2.3-723 or later
• Verify Ivanti Neurons for Secure Access is running version 22.8R1.4 or later (fix was deployed August 2, 2025)
• Review network access controls to limit exposure of management interfaces

Patch Information

Ivanti has released security patches addressing this vulnerability across all affected product lines. Organizations should consult the Ivanti Security Advisory for detailed patch information and download links.

For Ivanti Connect Secure, the fix is included in versions 22.7R2.8 and 22.8R2. For Ivanti Policy Secure, the fix is in version 22.7R1.5. For Ivanti ZTA Gateway, update to version 2.8R2.3-723 or later. Ivanti Neurons for Secure Access received an automatic fix deployment on August 2, 2025 in version 22.8R1.4.

Workarounds

• Implement network segmentation to restrict access to Ivanti appliances from untrusted networks where possible
• Deploy web application firewalls (WAF) or intrusion prevention systems (IPS) to filter potentially malicious traffic
• Limit internet-facing exposure of Ivanti services to only necessary IP ranges using firewall rules
• Enable rate limiting on connections to Ivanti services to mitigate the impact of denial of service attempts

# Example: Verify Ivanti Connect Secure version
# Access the admin console and navigate to System > Overview
# Ensure version is 22.7R2.8 or later, or 22.8R2 or later

# Example: Review firewall rules to restrict management access
iptables -L -n | grep -E "443|8443"
# Ensure management ports are restricted to trusted administrator networks