Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2025-55142 (GCVE-0-2025-55142)
Vulnerability from cvelistv5 – Published: 2025-09-09 15:49 – Updated: 2026-02-26 17:49
VLAI
EPSS
Summary
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
Severity
8.8 (High)
CWE
- CWE-862 - Missing Authorization
Assigner
References
1 reference
Impacted products
4 products
| Vendor | Product | Version | |
|---|---|---|---|
| Ivanti | Connect Secure |
Unaffected:
22.7R2.9
Unaffected: 22.8R2 |
|
| Ivanti | Policy Secure |
Unaffected:
22.7R1.6
|
|
| Ivanti | ZTA Gateway |
Unaffected:
2.8R2.3-723
|
|
| Ivanti | Neurons for Secure Access |
Unaffected:
22.8R1.4 (Fix deployed on 02-Aug-2025)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2025-55142",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-09-10T03:56:13.875022Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-02-26T17:49:02.701Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "affected",
"product": "Connect Secure",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "22.7R2.9"
},
{
"status": "unaffected",
"version": "22.8R2"
}
]
},
{
"defaultStatus": "affected",
"product": "Policy Secure",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "22.7R1.6"
}
]
},
{
"defaultStatus": "affected",
"product": "ZTA Gateway",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "2.8R2.3-723"
}
]
},
{
"defaultStatus": "affected",
"product": "Neurons for Secure Access",
"vendor": "Ivanti",
"versions": [
{
"status": "unaffected",
"version": "22.8R1.4 (Fix deployed on 02-Aug-2025)"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cspan style=\"background-color: rgb(242, 242, 242);\"\u003eMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.\u003c/span\u003e\u003cbr\u003e"
}
],
"value": "Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings."
}
],
"impacts": [
{
"capecId": "CAPEC-122",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-122 Privilege Abuse"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-862",
"description": "CWE-862 Missing Authorization",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-09-09T15:49:20.192Z",
"orgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"shortName": "ivanti"
},
"references": [
{
"url": "https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "Vulnogram 0.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"assignerShortName": "ivanti",
"cveId": "CVE-2025-55142",
"datePublished": "2025-09-09T15:49:20.192Z",
"dateReserved": "2025-08-07T16:15:48.896Z",
"dateUpdated": "2026-02-26T17:49:02.701Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2025-55142",
"date": "2026-05-28",
"epss": "0.03843",
"percentile": "0.88363"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2025-55142\",\"sourceIdentifier\":\"3c1d8aa1-5a33-4ea4-8992-aadd6440af75\",\"published\":\"2025-09-09T16:15:34.180\",\"lastModified\":\"2025-09-24T19:56:55.957\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"3c1d8aa1-5a33-4ea4-8992-aadd6440af75\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":8.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"3c1d8aa1-5a33-4ea4-8992-aadd6440af75\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-862\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"22.7\",\"matchCriteriaId\":\"201EB882-0B2A-47DB-B517-1E72A0542B27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"F788F6D9-5368-4B8E-BFA0-E8FB3CDADB01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2927A40D-E8A3-4DB6-9C93-04A6C6035C3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1399BBB4-E62B-4FF6-B9E3-6AAC68D4D583\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1EAD1423-4477-4C35-BF93-697A2C0697C6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*\",\"matchCriteriaId\":\"858353BC-12CB-4014-BFCA-DA7B1B3DD4B9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*\",\"matchCriteriaId\":\"865F72BF-57B2-4B0C-BACE-3500E0AE6751\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*\",\"matchCriteriaId\":\"39E11407-E0C0-454F-B731-7DA4CBC696EB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*\",\"matchCriteriaId\":\"247E71F8-A03B-4097-B7BF-09F8BF3ED4D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0059C69-4A18-4153-9D9A-5C1B03AD1453\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FC523C88-115E-4CD9-A8CB-AE6E6610F7D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*\",\"matchCriteriaId\":\"3447428E-DBCD-4553-B51D-AC08ECAFD881\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*\",\"matchCriteriaId\":\"A08BAF98-7F05-4596-8BFC-91F1A79D3BD1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.5:*:*:*:*:*:*\",\"matchCriteriaId\":\"40717D97-A062-49C4-B105-C22AAC3A206A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.6:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3019D80-C578-437E-A304-F49F1AEC24F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.7:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2EFC001-63D4-4FD0-8E14-C5A1C9E3BF9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:connect_secure:22.7:r2.8:*:*:*:*:*:*\",\"matchCriteriaId\":\"5100B9BD-3C11-4C22-9A5E-2FBFD06701EA\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"22.7\",\"matchCriteriaId\":\"FAD0FC91-CA1E-4DC3-A37E-1BF98906D07C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F22B988-2585-4853-9838-AB3746C8B888\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD9BE8C2-43EB-4870-A4B7-267CB17A19F1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8915BB2-C1C0-4189-A847-DDB2EF161D62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D24A8DB-D697-4C60-935D-B08EE36861CB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:r1.3:*:*:*:*:*:*\",\"matchCriteriaId\":\"4C12D325-77E1-4873-8A77-D76F4A73BCF8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:r1.4:*:*:*:*:*:*\",\"matchCriteriaId\":\"95E4AE0D-614C-4300-9ADB-8442EF9A84C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:policy_secure:22.7:r1.5:*:*:*:*:*:*\",\"matchCriteriaId\":\"7E6DEE21-6940-47B5-8733-B0C5BC045858\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:zero_trust_access_gateway:22.8:r2.2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E7C3FC1D-94CA-4594-ABF3-59829E43A692\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:neurons_for_secure_access:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"22.8\",\"matchCriteriaId\":\"7705B778-27AA-45D2-966E-2E5BE7CDC022\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A32A3778-B33F-4249-A248-745876B4CE48\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B415A830-5771-462F-8E55-790FFF7D5277\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E79007DD-C9A9-4DE8-AD06-FB5F9BAC4EBB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.3:*:*:*:*:*:*\",\"matchCriteriaId\":\"003B96FC-A3C7-4488-B0D0-7F7EFD9C762F\"}]}]}],\"references\":[{\"url\":\"https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US\",\"source\":\"3c1d8aa1-5a33-4ea4-8992-aadd6440af75\",\"tags\":[\"Vendor Advisory\"]}]}}",
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2025-55142\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-09-10T03:56:13.875022Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-09-09T16:05:06.525Z\"}}], \"cna\": {\"source\": {\"discovery\": \"UNKNOWN\"}, \"impacts\": [{\"capecId\": \"CAPEC-122\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-122 Privilege Abuse\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 8.8, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\", \"integrityImpact\": \"HIGH\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"HIGH\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"Ivanti\", \"product\": \"Connect Secure\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"22.7R2.9\"}, {\"status\": \"unaffected\", \"version\": \"22.8R2\"}], \"defaultStatus\": \"affected\"}, {\"vendor\": \"Ivanti\", \"product\": \"Policy Secure\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"22.7R1.6\"}], \"defaultStatus\": \"affected\"}, {\"vendor\": \"Ivanti\", \"product\": \"ZTA Gateway\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"2.8R2.3-723\"}], \"defaultStatus\": \"affected\"}, {\"vendor\": \"Ivanti\", \"product\": \"Neurons for Secure Access\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"22.8R1.4 (Fix deployed on 02-Aug-2025)\"}], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(242, 242, 242);\\\"\u003eMissing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.\u003c/span\u003e\u003cbr\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-862\", \"description\": \"CWE-862 Missing Authorization\"}]}], \"providerMetadata\": {\"orgId\": \"3c1d8aa1-5a33-4ea4-8992-aadd6440af75\", \"shortName\": \"ivanti\", \"dateUpdated\": \"2025-09-09T15:49:20.192Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2025-55142\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-02-26T17:49:02.701Z\", \"dateReserved\": \"2025-08-07T16:15:48.896Z\", \"assignerOrgId\": \"3c1d8aa1-5a33-4ea4-8992-aadd6440af75\", \"datePublished\": \"2025-09-09T15:49:20.192Z\", \"assignerShortName\": \"ivanti\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
CERTFR-2025-AVI-0768
Vulnerability from certfr_avis - Published: 2025-09-10 - Updated: 2025-09-10
De multiples vulnérabilités ont été découvertes dans les produits Ivanti. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à la confidentialité des données.
Solutions
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
Impacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Ivanti | Endpoint Manager (EPM) | Endpoint Manager versions 2024 SU3 antérieures à 2024 SU3 Security Release 1 | ||
| Ivanti | Zero Trust Access gateways | ZTA Gateways versions antérieures à 22.8R2.3-723 | ||
| Ivanti | Neurons | Neurons pour Secure Access versions antérieures à 22.8R1.4 | ||
| Ivanti | Endpoint Manager (EPM) | Endpoint Manager versions 2022 SU8 antérieures à 2022 SU8 Security Release 2 | ||
| Ivanti | Connect Secure (ICS) | Connect Secure versions antérieures à 22.7R2.9 | ||
| Ivanti | Policy Secure (IPS) | Policy Secure versions antérieures à 22.7R1.5 |
References
| Title | Publication Time | Tags | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Endpoint Manager versions 2024 SU3 ant\u00e9rieures \u00e0 2024 SU3 Security Release 1",
"product": {
"name": "Endpoint Manager (EPM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "ZTA Gateways versions ant\u00e9rieures \u00e0 22.8R2.3-723",
"product": {
"name": "Zero Trust Access gateways",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Neurons pour Secure Access versions ant\u00e9rieures \u00e0 22.8R1.4",
"product": {
"name": "Neurons",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Endpoint Manager versions 2022 SU8 ant\u00e9rieures \u00e0 2022 SU8 Security Release 2 ",
"product": {
"name": "Endpoint Manager (EPM)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Connect Secure versions ant\u00e9rieures \u00e0 22.7R2.9",
"product": {
"name": "Connect Secure (ICS)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
},
{
"description": "Policy Secure versions ant\u00e9rieures \u00e0 22.7R1.5",
"product": {
"name": "Policy Secure (IPS)",
"vendor": {
"name": "Ivanti",
"scada": false
}
}
}
],
"affected_systems_content": "",
"content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
"cves": [
{
"name": "CVE-2025-55145",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55145"
},
{
"name": "CVE-2025-8711",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8711"
},
{
"name": "CVE-2025-55139",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55139"
},
{
"name": "CVE-2025-9872",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9872"
},
{
"name": "CVE-2025-8712",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-8712"
},
{
"name": "CVE-2025-55142",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55142"
},
{
"name": "CVE-2025-9712",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-9712"
},
{
"name": "CVE-2025-55143",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55143"
},
{
"name": "CVE-2025-55148",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55148"
},
{
"name": "CVE-2025-55141",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55141"
},
{
"name": "CVE-2025-55144",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55144"
},
{
"name": "CVE-2025-55146",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55146"
},
{
"name": "CVE-2025-55147",
"url": "https://www.cve.org/CVERecord?id=CVE-2025-55147"
}
],
"initial_release_date": "2025-09-10T00:00:00",
"last_revision_date": "2025-09-10T00:00:00",
"links": [],
"reference": "CERTFR-2025-AVI-0768",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2025-09-10T00:00:00.000000"
}
],
"risks": [
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
},
{
"description": "Contournement de la politique de s\u00e9curit\u00e9"
},
{
"description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
},
{
"description": "Injection de code indirecte \u00e0 distance (XSS)"
},
{
"description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Ivanti. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Ivanti",
"vendor_advisories": [
{
"published_at": "2025-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs",
"url": "https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs"
},
{
"published_at": "2025-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti september-2025-security-update",
"url": "https://www.ivanti.com/blog/september-2025-security-update"
},
{
"published_at": "2025-09-09",
"title": "Bulletin de s\u00e9curit\u00e9 Ivanti Security-Advisory-September-2025-for-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8",
"url": "https://forums.ivanti.com/s/article/Security-Advisory-September-2025-for-Ivanti-EPM-2024-SU3-and-EPM-2022-SU8"
}
]
}
FKIE_CVE-2025-55142
Vulnerability from fkie_nvd - Published: 2025-09-09 16:15 - Updated: 2025-09-24 19:56
Severity
Summary
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| ivanti | connect_secure | * | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | connect_secure | 22.7 | |
| ivanti | policy_secure | * | |
| ivanti | policy_secure | 22.7 | |
| ivanti | policy_secure | 22.7 | |
| ivanti | policy_secure | 22.7 | |
| ivanti | policy_secure | 22.7 | |
| ivanti | policy_secure | 22.7 | |
| ivanti | policy_secure | 22.7 | |
| ivanti | policy_secure | 22.7 | |
| ivanti | zero_trust_access_gateway | 22.8 | |
| ivanti | neurons_for_secure_access | * | |
| ivanti | neurons_for_secure_access | 22.8 | |
| ivanti | neurons_for_secure_access | 22.8 | |
| ivanti | neurons_for_secure_access | 22.8 | |
| ivanti | neurons_for_secure_access | 22.8 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*",
"matchCriteriaId": "201EB882-0B2A-47DB-B517-1E72A0542B27",
"versionEndExcluding": "22.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*",
"matchCriteriaId": "F788F6D9-5368-4B8E-BFA0-E8FB3CDADB01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*",
"matchCriteriaId": "2927A40D-E8A3-4DB6-9C93-04A6C6035C3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*",
"matchCriteriaId": "1399BBB4-E62B-4FF6-B9E3-6AAC68D4D583",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "1EAD1423-4477-4C35-BF93-697A2C0697C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*",
"matchCriteriaId": "858353BC-12CB-4014-BFCA-DA7B1B3DD4B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*",
"matchCriteriaId": "865F72BF-57B2-4B0C-BACE-3500E0AE6751",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*",
"matchCriteriaId": "39E11407-E0C0-454F-B731-7DA4CBC696EB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*",
"matchCriteriaId": "247E71F8-A03B-4097-B7BF-09F8BF3ED4D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*",
"matchCriteriaId": "E0059C69-4A18-4153-9D9A-5C1B03AD1453",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*",
"matchCriteriaId": "FC523C88-115E-4CD9-A8CB-AE6E6610F7D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*",
"matchCriteriaId": "3447428E-DBCD-4553-B51D-AC08ECAFD881",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*",
"matchCriteriaId": "A08BAF98-7F05-4596-8BFC-91F1A79D3BD1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.5:*:*:*:*:*:*",
"matchCriteriaId": "40717D97-A062-49C4-B105-C22AAC3A206A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.6:*:*:*:*:*:*",
"matchCriteriaId": "C3019D80-C578-437E-A304-F49F1AEC24F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.7:*:*:*:*:*:*",
"matchCriteriaId": "A2EFC001-63D4-4FD0-8E14-C5A1C9E3BF9C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.8:*:*:*:*:*:*",
"matchCriteriaId": "5100B9BD-3C11-4C22-9A5E-2FBFD06701EA",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*",
"matchCriteriaId": "FAD0FC91-CA1E-4DC3-A37E-1BF98906D07C",
"versionEndExcluding": "22.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*",
"matchCriteriaId": "1F22B988-2585-4853-9838-AB3746C8B888",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*",
"matchCriteriaId": "FD9BE8C2-43EB-4870-A4B7-267CB17A19F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*",
"matchCriteriaId": "C8915BB2-C1C0-4189-A847-DDB2EF161D62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "8D24A8DB-D697-4C60-935D-B08EE36861CB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.3:*:*:*:*:*:*",
"matchCriteriaId": "4C12D325-77E1-4873-8A77-D76F4A73BCF8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.4:*:*:*:*:*:*",
"matchCriteriaId": "95E4AE0D-614C-4300-9ADB-8442EF9A84C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.5:*:*:*:*:*:*",
"matchCriteriaId": "7E6DEE21-6940-47B5-8733-B0C5BC045858",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ivanti:zero_trust_access_gateway:22.8:r2.2:*:*:*:*:*:*",
"matchCriteriaId": "E7C3FC1D-94CA-4594-ABF3-59829E43A692",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:*:*:*:*:*:*:*:*",
"matchCriteriaId": "7705B778-27AA-45D2-966E-2E5BE7CDC022",
"versionEndExcluding": "22.8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1:*:*:*:*:*:*",
"matchCriteriaId": "A32A3778-B33F-4249-A248-745876B4CE48",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.1:*:*:*:*:*:*",
"matchCriteriaId": "B415A830-5771-462F-8E55-790FFF7D5277",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "E79007DD-C9A9-4DE8-AD06-FB5F9BAC4EBB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.3:*:*:*:*:*:*",
"matchCriteriaId": "003B96FC-A3C7-4488-B0D0-7F7EFD9C762F",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings."
}
],
"id": "CVE-2025-55142",
"lastModified": "2025-09-24T19:56:55.957",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 2.8,
"impactScore": 5.9,
"source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"type": "Secondary"
}
]
},
"published": "2025-09-09T16:15:34.180",
"references": [
{
"source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"tags": [
"Vendor Advisory"
],
"url": "https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US"
}
],
"sourceIdentifier": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-862"
}
],
"source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"type": "Secondary"
}
]
}
GHSA-77HG-RFPF-5GHC
Vulnerability from github – Published: 2025-09-09 18:31 – Updated: 2025-09-09 18:31
VLAI
Details
Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2025-55142"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-09T16:15:34Z",
"severity": "HIGH"
},
"details": "Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with read-only admin privileges to configure authentication related settings.",
"id": "GHSA-77hg-rfpf-5ghc",
"modified": "2025-09-09T18:31:18Z",
"published": "2025-09-09T18:31:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55142"
},
{
"type": "WEB",
"url": "https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
NCSC-2025-0292
Vulnerability from csaf_ncscnl - Published: 2025-09-16 12:21 - Updated: 2025-09-16 12:21Summary
Kwetsbaarheden verholpen in Ivanti producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Ivanti heeft kwetsbaarheden verholpen in meerdere producten zoals Connect Secure en Policy Secure.
Interpretaties: De kwetsbaarheden bevinden zich in verschillende Ivanti producten en stellen remote geauthenticeerde aanvallers met read-only admin rechten in staat om authenticatie-instellingen te wijzigen, beperkte instellingen te configureren, bestaande HTML5-verbindingen te kapen, en CSRF-aanvallen uit te voeren. Dit kan leiden tot ongeautoriseerde wijzigingen in systeemconfiguraties, ongeautoriseerde toegang en manipulatie van actieve sessies, en het uitvoeren van gevoelige acties namens gebruikers. Daarnaast kunnen aanvallers met admin-rechten een denial-of-service conditie triggeren en interne services enumereren. Een kritieke kwetsbaarheid in Ivanti Connect Secure en andere producten stelt aanvallers in staat om willekeurige tekst in HTTP-responses te injecteren, wat gebruikersinteractie vereist voor exploitatie.
Oplossingen: Ivanti heeft updates uitgebracht om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CWE-252: Unchecked Return Value
CWE-352: Cross-Site Request Forgery (CSRF)
CWE-862: Missing Authorization
CWE-918: Server-Side Request Forgery (SSRF)
8.8 (High)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
8.8 (High)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
5.4 (Medium)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
7.6 (High)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
5.4 (Medium)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
8.9 (High)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
8.8 (High)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
5.4 (Medium)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
4.9 (Medium)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
6.8 (Medium)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
6.1 (Medium)
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Ivanti / Connect Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / Policy Secure
|
vers:unknown/* | ||
|
vers:unknown/*
Ivanti / ZTA Gateway
|
vers:unknown/* |
References
12 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Ivanti heeft kwetsbaarheden verholpen in meerdere producten zoals Connect Secure en Policy Secure.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden bevinden zich in verschillende Ivanti producten en stellen remote geauthenticeerde aanvallers met read-only admin rechten in staat om authenticatie-instellingen te wijzigen, beperkte instellingen te configureren, bestaande HTML5-verbindingen te kapen, en CSRF-aanvallen uit te voeren. Dit kan leiden tot ongeautoriseerde wijzigingen in systeemconfiguraties, ongeautoriseerde toegang en manipulatie van actieve sessies, en het uitvoeren van gevoelige acties namens gebruikers. Daarnaast kunnen aanvallers met admin-rechten een denial-of-service conditie triggeren en interne services enumereren. Een kritieke kwetsbaarheid in Ivanti Connect Secure en andere producten stelt aanvallers in staat om willekeurige tekst in HTTP-responses te injecteren, wat gebruikersinteractie vereist voor exploitatie.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Ivanti heeft updates uitgebracht om deze kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "general",
"text": "Unchecked Return Value",
"title": "CWE-252"
},
{
"category": "general",
"text": "Cross-Site Request Forgery (CSRF)",
"title": "CWE-352"
},
{
"category": "general",
"text": "Missing Authorization",
"title": "CWE-862"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs"
}
],
"title": "Kwetsbaarheden verholpen in Ivanti producten",
"tracking": {
"current_release_date": "2025-09-16T12:21:50.959347Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2025-0292",
"initial_release_date": "2025-09-16T12:21:50.959347Z",
"revision_history": [
{
"date": "2025-09-16T12:21:50.959347Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Connect Secure"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Policy Secure"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "ZTA Gateway"
}
],
"category": "vendor",
"name": "Ivanti"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-55141",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55141 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55141.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55141"
},
{
"cve": "CVE-2025-55142",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55142 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55142.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55142"
},
{
"cve": "CVE-2025-55144",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55144 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55144.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55144"
},
{
"cve": "CVE-2025-55148",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55148 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55148.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55148"
},
{
"cve": "CVE-2025-8712",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-8712 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-8712.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-8712"
},
{
"cve": "CVE-2025-55145",
"cwe": {
"id": "CWE-862",
"name": "Missing Authorization"
},
"notes": [
{
"category": "other",
"text": "Missing Authorization",
"title": "CWE-862"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55145 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55145.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.9,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55145"
},
{
"cve": "CVE-2025-55147",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"notes": [
{
"category": "other",
"text": "Cross-Site Request Forgery (CSRF)",
"title": "CWE-352"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55147 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55147.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55147"
},
{
"cve": "CVE-2025-8711",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"notes": [
{
"category": "other",
"text": "Cross-Site Request Forgery (CSRF)",
"title": "CWE-352"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-8711 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-8711.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-8711"
},
{
"cve": "CVE-2025-55146",
"cwe": {
"id": "CWE-252",
"name": "Unchecked Return Value"
},
"notes": [
{
"category": "other",
"text": "Unchecked Return Value",
"title": "CWE-252"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55146 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55146.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55146"
},
{
"cve": "CVE-2025-55139",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55139 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55139.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55139"
},
{
"cve": "CVE-2025-55143",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-55143 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-55143.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3"
]
}
],
"title": "CVE-2025-55143"
}
]
}
WID-SEC-W-2025-2010
Vulnerability from csaf_certbund - Published: 2025-09-09 22:00 - Updated: 2025-09-09 22:00Summary
Ivanti Connect Secure und Policy Secure: Mehrere Schwachstellen
Severity
Hoch
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung: Connect Secure bietet TLS- und mobile VPN-Lösungen.
Ivanti Policy Secure ist eine Network Access Control (NAC) Lösung.
Angriff: Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen in Ivanti Connect Secure und Ivanti Policy Secure ausnutzen, um Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuführen.
Betroffene Betriebssysteme: - Sonstiges
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
Affected products
Known affected
3 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Ivanti Connect Secure <22.8R2
Ivanti / Connect Secure
|
<22.8R2 | ||
|
Ivanti Policy Secure <22.7R1.5
Ivanti / Policy Secure
|
<22.7R1.5 | ||
|
Ivanti Connect Secure <22.7R2.9
Ivanti / Connect Secure
|
<22.7R2.9 |
References
3 references
{
"document": {
"aggregate_severity": {
"text": "hoch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Connect Secure bietet TLS- und mobile VPN-L\u00f6sungen.\r\nIvanti Policy Secure ist eine Network Access Control (NAC) L\u00f6sung.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen in Ivanti Connect Secure und Ivanti Policy Secure ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen, Daten zu manipulieren, einen Denial-of-Service-Zustand zu verursachen, vertrauliche Informationen offenzulegen und Cross-Site-Scripting-Angriffe durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Sonstiges",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2025-2010 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2010.json"
},
{
"category": "self",
"summary": "WID-SEC-2025-2010 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2010"
},
{
"category": "external",
"summary": "September Security Advisory Ivanti Connect Secure, Policy Secure, ZTA Gateways and Neurons for Secure Access vom 2025-09-09",
"url": "https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US"
}
],
"source_lang": "en-US",
"title": "Ivanti Connect Secure und Policy Secure: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2025-09-09T22:00:00.000+00:00",
"generator": {
"date": "2025-09-10T07:36:06.448+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.4.0"
}
},
"id": "WID-SEC-W-2025-2010",
"initial_release_date": "2025-09-09T22:00:00.000+00:00",
"revision_history": [
{
"date": "2025-09-09T22:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c22.7R2.9",
"product": {
"name": "Ivanti Connect Secure \u003c22.7R2.9",
"product_id": "T046847"
}
},
{
"category": "product_version",
"name": "22.7R2.9",
"product": {
"name": "Ivanti Connect Secure 22.7R2.9",
"product_id": "T046847-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ivanti:connect_secure:22.7r2.9"
}
}
},
{
"category": "product_version_range",
"name": "\u003c22.8R2",
"product": {
"name": "Ivanti Connect Secure \u003c22.8R2",
"product_id": "T046848"
}
},
{
"category": "product_version",
"name": "22.8R2",
"product": {
"name": "Ivanti Connect Secure 22.8R2",
"product_id": "T046848-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ivanti:connect_secure:22.8r2"
}
}
}
],
"category": "product_name",
"name": "Connect Secure"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003c22.7R1.5",
"product": {
"name": "Ivanti Policy Secure \u003c22.7R1.5",
"product_id": "T046849"
}
},
{
"category": "product_version",
"name": "22.7R1.5",
"product": {
"name": "Ivanti Policy Secure 22.7R1.5",
"product_id": "T046849-fixed",
"product_identification_helper": {
"cpe": "cpe:/a:ivanti:policy_secure:22.7r1.5"
}
}
}
],
"category": "product_name",
"name": "Policy Secure"
}
],
"category": "vendor",
"name": "Ivanti"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-55141",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55141"
},
{
"cve": "CVE-2025-55142",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55142"
},
{
"cve": "CVE-2025-55144",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55144"
},
{
"cve": "CVE-2025-55148",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55148"
},
{
"cve": "CVE-2025-8712",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-8712"
},
{
"cve": "CVE-2025-55145",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55145"
},
{
"cve": "CVE-2025-55147",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55147"
},
{
"cve": "CVE-2025-8711",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-8711"
},
{
"cve": "CVE-2025-55146",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55146"
},
{
"cve": "CVE-2025-55139",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55139"
},
{
"cve": "CVE-2025-55143",
"product_status": {
"known_affected": [
"T046848",
"T046849",
"T046847"
]
},
"release_date": "2025-09-09T22:00:00.000+00:00",
"title": "CVE-2025-55143"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…