CVE-2025-22457
CRITICAL KEV RANSOMWARE NUCLEIIvanti Connect Secure Unauthenticated Remote Code Execution via Stack-based Buffer Overflow
Title source: metasploitExploitation Summary
CVE-2025-22457 is actively exploited and listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, added April 4, 2025, with confirmed use in ransomware campaigns.
EIP tracks 5 public exploits from researchers including sfewer-r7, securekomodo, Vinylrider, including a Metasploit module exploits/linux/http/ivanti_connect_secure_stack_overflow_rce_cve_2025_22457.
A Nuclei detection template is also available.
AI-analyzed exploit summary This is a functional exploit for CVE-2025-22457, targeting Ivanti Connect Secure for unauthenticated remote code execution via a heap spray and stack pivot technique. It includes a reverse shell payload and brute-forces the libdsplibs.so base address.
Description
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7R1.4, and Ivanti ZTA Gateways before version 22.8R2.2 allows a remote unauthenticated attacker to achieve remote code execution.
Exploits (5)
This is a functional exploit for CVE-2025-22457, targeting Ivanti Connect Secure for unauthenticated remote code execution via a heap spray and stack pivot technique. It includes a reverse shell payload and brute-forces the libdsplibs.so base address.
This is a scanner for CVE-2025-22457, a stack-based buffer overflow in Ivanti Connect Secure. It checks for vulnerability by sending a crafted X-Forwarded-For header and verifying crash conditions.
This repository provides a mitigation tool for CVE-2025-22457, an X-Forwarded-For header vulnerability in Ivanti/Juniper Secure Connect SSL VPN. It implements a Python-based HTTPS gateway that enforces password authentication before allowing access to the VPN appliance via iptables rules.
This is a functional exploit for CVE-2025-22457, targeting Ivanti Connect Secure for unauthenticated remote code execution via a heap spray and stack pivot technique. It includes a reverse shell payload and brute-forces memory addresses to achieve execution.
This Metasploit module exploits a stack-based buffer overflow in Ivanti Connect Secure (CVE-2025-22457) to achieve unauthenticated remote code execution. It uses heap spraying and ROP chain techniques to bypass ASLR and execute arbitrary commands.
Nuclei Templates (1)
http.title:"ivanti connect secure"
title="ivanti connect secure"
References (2)
Scores
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H