Ivanti Vulnerabilities CVE 2025 0282 And CVE 2025 0283
Query
DeviceTvmSoftwareInventory
| where SoftwareVendor has "ivanti"
| extend SoftwareVersionD =replace_string(SoftwareVersion,".","")
| extend firstDigits = toint(substring(SoftwareVersionD,0,5))
| where firstDigits < 22731 and (SoftwareName startswith "ivanti_secure_access" or SoftwareName has "pulse_application_launcher" )
| distinct DeviceName,SoftwareVersion, SoftwareName, SoftwareVendor ```About this query
MITRE ATT&CK Technique(s)
| Technique ID | Title |
|---|---|
| T1190 | Exploit Public-Facing Application |
Author: Sergio Albea (09/01/2025)
Ivanti Vulnerabilities CVE-2025-0282 and CVE-2025-0283
ššš-šššš-šššš 9.0 (Critical) A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a remote unauthenticated attacker to achieve remote code execution.
ššš-šššš-šššš 7.0 (High) A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.5, Ivanti Policy Secure before version 22.7R1.2, and Ivanti Neurons for ZTA gateways before version 22.7R2.3 allows a local authenticated attacker to escalate their privileges.
This query detect previous versions of Ivanti Connect Secure 22.7R2.5 to be updated ASAP using the patch provided by Ivanti.
Ivanti Secure Access Client: ivanti_secure_access = VPN client Only pulse_application_launcher = VPN client with launcher (needed for MFA login with mini browser in client )
Explanation
This query is designed to identify devices that are running outdated versions of Ivanti software, specifically those that are vulnerable to two critical security issues (CVE-2025-0282 and CVE-2025-0283). These vulnerabilities involve a stack-based buffer overflow that could allow attackers to execute code remotely or escalate privileges.
Here's a simple breakdown of the query:
-
Data Source: The query looks at the
DeviceTvmSoftwareInventoryto find software information on devices. -
Filter by Vendor: It filters the software list to include only those from the vendor "Ivanti".
-
Version Check: It processes the software version numbers to a comparable format and checks if they are older than a specific version (22.7R2.5). This is done by converting the version number into a numerical format and comparing it.
-
Software Identification: It specifically looks for software names that start with "ivanti_secure_access" or contain "pulse_application_launcher", which are related to Ivanti's VPN client software.
-
Output: The query outputs a distinct list of device names, software versions, software names, and vendors for those devices that have outdated and potentially vulnerable Ivanti software installed.
The goal is to ensure these devices are updated as soon as possible using the patches provided by Ivanti to mitigate the security risks associated with the identified vulnerabilities.
