Ivanti Connect Secure, Policy Secure, and Neurons for ZTA Gateways Privilege Escalation Vulnerability

A stack-based buffer overflow vulnerability has been identified in Ivanti Connect Secure versions prior to 22.7R2.5, Ivanti Policy Secure versions prior to 22.7R1.2, and Ivanti Neurons for ZTA gateways versions prior to 22.7R2.3. This vulnerability allows a local authenticated attacker to escalate privileges.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation.

Remediation

Users of Ivanti Connect Secure should upgrade to version 22.7R2.5. For Ivanti Policy Secure, the fix will be available in version 22.7R1.3, scheduled for release on January 21, 2025. Ivanti Neurons for ZTA Gateways have already been updated to the patched version 22.8R2.