UNC5221’s Latest Exploit: Weaponizing CVE-2025-22457 in Ivanti Connect Secure
picussecurity.com · Undated · Licence: not cleared; local research copy only
CVEs this report names
1 CVE- CVE-2025-22457Ivanti Connect Secure, Policy Secure, and ZTA Gateways Stack-Based Buffer Overflow VulnerabilityIvanti · Connect Secure, Policy Secure, and ZTA GatewaysKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter1 report>99.9%Top 0.02%83.7priority
Where it names them
CVE-2025-22457 Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗ Original (opens in a new tab) ↗
CVE-2025-22457 in Ivanti Connect Secure
In mid-March 2025, UNC5221 launched a fresh campaign exploiting a critical Ivanti Connect Secure vulnerability (CVE-2025-22457) to gain unauthorized access to organizations’ networks.
The Ivanti Connect Secure Vulnerability (CVE-2025-22457) Explained
On April 3, 2025, Ivanti publicly disclosed CVE-2025-22457, a critical stack-based buffer overflow affecting Ivanti Connect Secure VPN appliances (version 22.7R2.5 and earlier).
In reality, CVE-2025-22457 turned out to be exploitable for unauthenticated remote code execution (RCE).
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.