Ivanti has disclosed particulars of a now-patched crucial safety vulnerability impacting its Join Safe that has come beneath lively exploitation within the wild.
The vulnerability, tracked as CVE-2025-22457 (CVSS rating: 9.0), considerations a case of a stack-based buffer overflow that may very well be exploited to execute arbitrary code on affected techniques.
“A stack-based buffer overflow in Ivanti Join Safe earlier than model 22.7R2.6, Ivanti Coverage Safe earlier than model 22.7R1.4, and Ivanti ZTA Gateways earlier than model 22.8R2.2 permits a distant unauthenticated attacker to realize distant code execution,” Ivanti stated in an alert launched Thursday.
The flaw impacts the next merchandise and variations –
- Ivanti Join Safe (variations 22.7R2.5 and prior) – Mounted in model 22.7R2.6 (Patch launched on February 11, 2025)
- Pulse Join Safe (variations 9.1R18.9 and prior) – Mounted in model 22.7R2.6 (Contact Ivanti emigrate because the gadget has reached end-of-support as of December 31, 2024)
- Ivanti Coverage Safe (variations 22.7R1.3 and prior) – Mounted in model 22.7R1.4 (To be obtainable on April 21)
- ZTA Gateways (variations 22.8R2 and prior) – Mounted in model 22.8R2.2 (To be obtainable on April 19)
The corporate stated it is conscious of a “restricted variety of prospects” whose Join Safe and end-of-support Pulse Join Safe home equipment have been exploited. There isn’t any proof that Coverage Safe or ZTA gateways have come beneath in-the-wild abuse.
“Clients ought to monitor their exterior ICT and search for net server crashes,” Ivanti famous. “In case your ICT outcome exhibits indicators of compromise, it is best to carry out a manufacturing unit reset on the equipment after which put the equipment again into manufacturing utilizing model 22.7R2.6.”
It is value mentioning right here that Join Safe model 22.7R2.6 additionally addressed a number of crucial vulnerabilities (CVE-2024-38657, CVE-2025-22467, and CVE-2024-10644) that would allow a distant authenticated attacker to write down arbitrary information and execute arbitrary code.
Google-owned Mandiant, in a bulletin of its personal, stated it noticed proof of exploitation of CVE-2025-22457 in mid-March 2025, permitting the risk actors to ship an in-memory dropper referred to as TRAILBLAZE, a passive backdoor codenamed BRUSHFIRE, and the SPAWN malware suite.
The assault chain basically entails using a multi-stage shell script dropper to execute TRAILBLAZE, which then injects BRUSHFIRE immediately into the reminiscence of a working net course of in an try and sidestep detection. The exploitation exercise is designed to determine persistent backdoor entry on compromised home equipment, doubtlessly enabling credential theft, additional community intrusion, and knowledge exfiltration.
The usage of SPAWN is attributed to a China-nexus adversary tracked as UNC5221, which has a historical past of leveraging zero-day flaws in Ivanti Join Safe (ICS) gadgets, alongside different clusters equivalent to UNC5266, UNC5291, UNC5325, UNC5330, UNC5337, and UNC3886.
UNC5221, per the U.S. authorities, has additionally been assessed to share overlaps with risk teams equivalent to APT27, Silk Hurricane, and UTA0178. Nevertheless, the risk intelligence agency informed The Hacker Information that it doesn’t have sufficient proof by itself to substantiate this connection.
“Mandiant tracks UNC5221 as a cluster of exercise that has repeatedly exploited edge gadgets with zero-day vulnerabilities,” Dan Perez, China Mission Technical Lead, Google Risk Intelligence Group, informed the publication.
“The hyperlink between this cluster and APT27 made by the federal government is believable, however we would not have unbiased proof to substantiate. Silk Hurricane is Microsoft’s title for this exercise, and we won’t converse to their attribution.”
UNC5221 has additionally been noticed leveraging an obfuscation community of compromised Cyberoam home equipment, QNAP gadgets, and ASUS routers to masks their true supply throughout intrusion operations, a facet additionally highlighted by Microsoft early final month, detailing Silk Hurricane’s newest tradecraft.
The corporate additional theorized that the risk actor probably analyzed the February patch launched by Ivanti and discovered a approach to exploit prior variations with the intention to obtain distant code execution towards unpatched techniques. The event marks the primary time UNC5221 has been attributed to the N-day exploitation of a safety flaw in Ivanti gadgets.
“This newest exercise from UNC5221 underscores the continuing concentrating on of edge gadgets globally by China-nexus espionage teams,” Charles Carmakal, Mandiant Consulting CTO, stated.
“These actors will proceed to analysis safety vulnerabilities and develop customized malware for enterprise techniques that do not assist EDR options. The rate of cyber intrusion exercise by China-nexus espionage actors continues to extend and these actors are higher than ever.”