Ivanti Connect Secure authentication bypass: running commands on the VPN appliance without logging in

Who is affected

The version numbers in the table (22.8R2.4, 25.1.1.1, 25.1.2.2 and so on) come from Ivanti’s advisory as cited by Rapid7. NVD’s version ranges are 22.8R2 through 22.8R2.4, 25.1.0.0 up to but not including 25.1.1.2, and 25.1.2.0 up to but not including 25.1.3.0; NVD does not list “25.1.2.2” as a version number. The CVE record (CNA: Ivanti) instead describes everything “before 25.1.3.0” as affected, with a default status of affected; its unaffected list contains only 25.1.3.0, 25.1.3.1, 22.8R2.5 and 22.7R2.14.

The 25.1.1.2 disagreement: Rapid7 (citing Ivanti) and NVD’s version ranges treat 25.1.1.2 as fixed. But the CNA description in the CVE record says everything “before 25.1.3.0” is affected, and its list of unaffected versions does not include 25.1.1.2. This matters because runZero says 25.1.1.2 is exactly the 25.1 upgrade path on ISA6000/ISA8000 hardware. Ivanti’s advisory page did not render when we tried to read it, so we could not confirm this directly.

How it works

Ivanti Connect Secure (ICS) is a VPN appliance that companies use to let employees connect to the office network from outside. This flaw is CWE-290, “authentication bypass by spoofing”: the appliance treats some signal an attacker can fake as proof of being logged in, and skips the login check. In broad terms, per Volexity’s write-up (that page contains exploit code, so we do not link to it): the appliance decides whether to let a request through based on its URL (a public page that needs no login), but decides which internal program actually handles it based on a header the request supplies itself. Because the access decision and the real destination don’t match, the request can reach programs that should require a login. For the remote code execution part, Volexity says an upload handler writes a file to disk first and checks it afterwards, and the gap between the two creates a race condition. This is closed-source appliance software, and no fix code is available to examine.

According to Volexity, this one CVE actually covers two flaws: the authentication bypass plus a remote code execution (RCE, meaning the attacker can run their own commands remotely) bug. Chained together, they let the attacker run commands as the cgi-server system user, which is not the all-powerful root account. In the real attacks, the attacker then chained a third flaw, not part of this CVE and not yet patched, to escalate to root.

The general CWE-290 mistake (conceptual illustration, not Ivanti’s code):

# Flawed approach: trust the identity the request claims for itself
if request.claims_to_be_trusted():
    skip_login()

# Fixed approach: identity comes only from credentials verified on the server
session = verify_credentials_server_side(request)
if not session:
    reject()

Because the chain patches library code only in memory and restores the configuration data, Ivanti’s Integrity Checker Tool sees no changes (Volexity). Separately, the attacker deleted evidence from Ivanti debug logs and Linux audit logs.

Scoring: The CNA’s CVSS 3.1 score is 8.6 (High). Rapid7 calls it a “CVSSv3.0” score and runZero’s headline calls it “Critical”; both are minor inconsistencies with the CVE record. CISA’s SSVC assessment rates exploitation as active, the flaw as automatable, and the technical impact as total.

Timeline

Further reading

• How “zero-day” applies: Rapid7 says exploitation happened before disclosure, making it a zero-day, and the victim Volexity confirmed ran 22.8R2.4, which was fully patched at the time (per Volexity). But Rapid7 also says part of the issue was already fixed in 25.1.3.0 in July. Our analysis: “zero-day” applies to branches that had not yet received the backported fix (such as 22.8), not to 25.1.3.0.
• Scale and attacker: Volexity has confirmed one victim; BleepingComputer quotes Ivanti as calling the exploitation “limited”. Volexity tracks the attacker as UTA0576 and assesses with low confidence that the motive is criminal rather than espionage. CISA lists ransomware use as Unknown.
• Start date differs: Volexity says October 3, Defused says October 1; the two firms may simply have seen different activity.
• Discovery credit differs: BleepingComputer says Volexity found and reported the flaw; Rapid7 says Ivanti found part of it internally; the discovery field in the CVE record (CNA: Ivanti) says UNKNOWN, while Volexity itself says it reported the flaw to Ivanti.
• Indicators of compromise: Rapid7, citing Ivanti, says no reliable indicators were available at advisory time; Volexity has published some (that page contains exploit code, so we do not link to it).
• Data quality: The advisory URL in CISA’s KEV notes is malformed (https:/forums.ivanti.com) and differs from the hub.ivanti.com URL in the CVE and NVD records. No source says when the vulnerable code was introduced.
• Related weakness type: CWE-290.