Ivanti has disclosed particulars of a now-patched important security vulnerability impacting its Join Safe that has come below lively exploitation within the wild.
The vulnerability, tracked as CVE-2025-22457 (CVSS rating: 9.0), considerations a case of a stack-based buffer overflow that could possibly be exploited to execute arbitrary code on affected methods.
“A stack-based buffer overflow in Ivanti Join Safe earlier than model 22.7R2.6, Ivanti Coverage Safe earlier than model 22.7R1.4, and Ivanti ZTA Gateways earlier than model 22.8R2.2 permits a distant unauthenticated attacker to realize distant code execution,” Ivanti stated in an alert launched Thursday.
The flaw impacts the next merchandise and variations –
- Ivanti Join Safe (variations 22.7R2.5 and prior) – Mounted in model 22.7R2.6 (Patch launched on February 11, 2025)
- Pulse Join Safe (variations 9.1R18.9 and prior) – Mounted in model 22.7R2.6 (Contact Ivanti emigrate because the system has reached end-of-support as of December 31, 2024)
- Ivanti Coverage Safe (variations 22.7R1.3 and prior) – Mounted in model 22.7R1.4 (To be accessible on April 21)
- ZTA Gateways (variations 22.8R2 and prior) – Mounted in model 22.8R2.2 (To be accessible on April 19)
The corporate stated it is conscious of a “restricted variety of clients” whose Join Safe and end-of-support Pulse Join Safe home equipment have been exploited. There is no such thing as a proof that Coverage Safe or ZTA gateways have come below in-the-wild abuse.
“Prospects ought to monitor their exterior ICT and search for internet server crashes,” Ivanti famous. “In case your ICT consequence reveals indicators of compromise, it’s best to carry out a manufacturing facility reset on the equipment after which put the equipment again into manufacturing utilizing model 22.7R2.6.”
It is value mentioning right here that Join Safe model 22.7R2.6 additionally addressed a number of important vulnerabilities (CVE-2024-38657, CVE-2025-22467, and CVE-2024-10644) that might allow a distant authenticated attacker to write down arbitrary recordsdata and execute arbitrary code.
Google-owned Mandiant, in a bulletin of its personal, stated it noticed proof of exploitation of CVE-2025-22457 in mid-March 2025, permitting the risk actors to ship an in-memory dropper known as TRAILBLAZE, a passive backdoor codenamed BRUSHFIRE, and the SPAWN malware suite.
The assault chain primarily entails the usage of a multi-stage shell script dropper to execute TRAILBLAZE, which then injects BRUSHFIRE immediately into the reminiscence of a working internet course of in an try and sidestep detection. The exploitation exercise is designed to ascertain persistent backdoor entry on compromised home equipment, probably enabling credential theft, additional community intrusion, and information exfiltration.
The usage of SPAWN is attributed to a China-nexus adversary tracked as UNC5221, which has a historical past of leveraging zero-day flaws in Ivanti Join Safe (ICS) gadgets, alongside different clusters similar to UNC5266, UNC5291, UNC5325, UNC5330, UNC5337, and UNC3886.
UNC5221, per the U.S. authorities, has additionally been assessed to share overlaps with risk teams similar to APT27, Silk Hurricane, and UTA0178. Nonetheless, the risk intelligence agency instructed The Hacker Information that it doesn’t have sufficient proof by itself to verify this connection.
“Mandiant tracks UNC5221 as a cluster of exercise that has repeatedly exploited edge gadgets with zero-day vulnerabilities,” Dan Perez, China Mission Technical Lead, Google Risk Intelligence Group, instructed the publication.
“The hyperlink between this cluster and APT27 made by the federal government is believable, however we should not have unbiased proof to verify. Silk Hurricane is Microsoft’s identify for this exercise, and we will not communicate to their attribution.”
UNC5221 has additionally been noticed leveraging an obfuscation community of compromised Cyberoam home equipment, QNAP gadgets, and ASUS routers to masks their true supply throughout intrusion operations, a side additionally highlighted by Microsoft early final month, detailing Silk Hurricane’s newest tradecraft.
The corporate additional theorized that the risk actor possible analyzed the February patch launched by Ivanti and discovered a approach to exploit prior variations so as to obtain distant code execution in opposition to unpatched methods. The event marks the primary time UNC5221 has been attributed to the N-day exploitation of a security flaw in Ivanti gadgets.
“This newest exercise from UNC5221 underscores the continued focusing on of edge gadgets globally by China-nexus espionage teams,” Charles Carmakal, Mandiant Consulting CTO, stated.
“These actors will proceed to analysis security vulnerabilities and develop customized malware for enterprise methods that do not assist EDR options. The speed of cyber intrusion exercise by China-nexus espionage actors continues to extend and these actors are higher than ever.”
