Security researchers from Rapid7 are publishing an RCE method related to a critical vulnerability in Ivanti's Connect Secure VPN, increasing the urgency for organizations to apply available updates.
See also: Vulnerabilities fixed in Ivanti, VMware, Zoom products
The publication of the exploit code comes less than a week after Mandiant warned of an exploit of the Ivanti vulnerability (CVE-2025-22457) by a Chinese hacking group known for its attacks on network devices.
Although the issue was patched in February, Ivanti had misdiagnosed it as a “product bug” and had not issued a publicly documented CVE identifier. It was only when Mandiant’s impact team discovered the Chinese hacking campaign that Ivanti published an advisory detailing the issue.
A week after the public disclosure, Rapid7 researchers are warning that attackers can exploit certain carefully crafted HTTP headers to upgrade the exploit from a simple crash to full remote code execution.
See also: Ivanti fixes vulnerabilities in ICS, IPS and CSA products
According to technical analysis , the RCE vulnerability stems from an unchecked buffer overflow in the HTTP(S) web server component of Ivanti Connect Secure VPN software. The researchers identified the vulnerability in a function that processes the “X-Forwarded-For” header and, by manipulating the length of the header value, were able to cause an overflow that overwrites critical parts of the stack.
The vulnerability, which has a CVSS severity rating of 9/10 , affects Ivanti Connect Secure versions 22.7R2.5 and earlier , as well as Pulse Connect Secure 9.x devices that have stopped being supported.
Ivanti customers are urged to immediately upgrade to version 22.7R2.6 of VPN Connect Secure appliances and migrate from unsupported Pulse Connect Secure appliances to protect themselves from the RCE vulnerability.
See also: Hackers exploit old vulnerabilities in Ivanti CSA
RCE vulnerabilities are a type of security flaw that allows a remote attacker to execute arbitrary code on a vulnerable computer or server without having physical access to it. This can happen through the exploitation of bugs in the software, poor input validation, or misconfigurations. RCE vulnerabilities are considered among the most serious because they can give an attacker complete control of the system, which can lead to data loss, personal information breach, or even a complete collapse of services. RCE attacks can be carried out through websites, applications, or even simple files opened in an unsecured environment. Their detection and remediation is a priority for any organization dealing with information security.
Source: securityweek
