Full Report
Ivanti has released security updates for Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), and Ivanti Secure Access Client (ISAC) to address multiple vulnerabilities, including three critical severity problems. [...]
Analysis Summary
# Vulnerability: Ivanti Connect Secure & Policy Secure Critical Flaws
## CVE Details
- CVE ID: CVE-2025-22467, CVE-2024-38657, CVE-2024-10644 (Three critical flaws detailed)
- CVSS Score: 9.9 (Critical) for CVE-2025-22467; 9.1 (Critical) for CVE-2024-38657 and CVE-2024-10644.
- CWE: Multiple (Including Stack-based buffer overflow, External control of a filename, Code injection)
## Affected Systems
- Products: Ivanti Connect Secure (ICS), Ivanti Policy Secure (IPS), Ivanti Secure Access Client (ISAC)
- Versions:
- ICS: 22.7R2.5 and older
- IPS: 22.7R1.2 and older
- ISAC: 22.7R4 and below
- *Note: Pulse Connect Secure 9.x is also affected but is End-of-Support and will not receive fixes.*
- Configurations: Remote exploitation noted for all three critical flaws, requiring attacker authentication. Admin privileges are necessary for file writing (CVE-2024-38657) and RCE (CVE-2024-10644).
## Vulnerability Description
Ivanti patched three critical vulnerabilities:
1. **CVE-2025-22467 (CVSS 9.9):** A stack-based buffer overflow in ICS allowing remote authenticated, low-privilege attackers to execute code.
2. **CVE-2024-38657 (CVSS 9.1):** External control of a filename in ICS and IPS allows remote authenticated attackers to perform arbitrary file writing.
3. **CVE-2024-10644 (CVSS 9.1):** A code injection vulnerability in ICS and IPS enables remote authenticated attackers to achieve remote code execution.
Also addressed were five lower-severity issues, including XSS, hardcoded keys, cleartext storage of sensitive data, and insufficient permissions.
## Exploitation
- Status: Not explicitly detailed as exploited in the wild for these three specific CVEs, but the potential risk is high due to the critical severity.
- Complexity: Requires the attacker to be authenticated, though one flaw allows RCE with low privileges.
- Attack Vector: Remote.
## Impact
- Confidentiality: High (Likely due to RCE capability)
- Integrity: High (Due to arbitrary file writing and RCE)
- Availability: High (Due to potential system compromise or denial of service via RCE)
## Remediation
### Patches
- ICS: Upgrade to version **22.7R2.6** or later.
- IPS: Upgrade to version **22.7R1.3** or later.
- ISAC: Upgrade to version **22.8R1** or later.
### Workarounds
- Ivanti has not provided specific workarounds for the critical flaws; applying the latest update is the recommended solution.
## Detection
- Detection methods and tools were not specified in the provided context for these new CVEs, but monitoring for unusual authenticated activity, file write attempts, or unexpected process execution on ICS/IPS appliances should be prioritized.
## References
- Vendor Advisories: Ivanti Security Advisory (February updates, specific link defanged: `https://forums.ivanti.com/s/article/February-Security-Advisory-Ivanti-Connect-Secure-ICS-Ivanti-Policy-Secure-IPS-and-Ivanti-Secure-Access-Client-ISAC-Multiple-CVEs?language=en_US`)