Ivanti has disclosed particulars of a now-patched essential safety vulnerability impacting its Join Safe that has come below energetic exploitation within the wild.
The vulnerability, tracked as CVE-2025-22457 (CVSS rating: 9.0), issues a case of a stack-based buffer overflow that could possibly be exploited to execute arbitrary code on affected methods.
“A stack-based buffer overflow in Ivanti Join Safe earlier than model 22.7R2.6, Ivanti Coverage Safe earlier than model 22.7R1.4, and Ivanti ZTA Gateways earlier than model 22.8R2.2 permits a distant unauthenticated attacker to realize distant code execution,” Ivanti mentioned in an alert launched Thursday.
The flaw impacts the next merchandise and variations –
- Ivanti Join Safe (variations 22.7R2.5 and prior) – Fastened in model 22.7R2.6 (Patch launched on February 11, 2025)
- Pulse Join Safe (variations 9.1R18.9 and prior) – Fastened in model 22.7R2.6 (Contact Ivanti emigrate because the machine has reached end-of-support as of December 31, 2024)
- Ivanti Coverage Safe (variations 22.7R1.3 and prior) – Fastened in model 22.7R1.4 (To be out there on April 21)
- ZTA Gateways (variations 22.8R2 and prior) – Fastened in model 22.8R2.2 (To be out there on April 19)
The corporate mentioned it is conscious of a “restricted variety of prospects” whose Join Safe and end-of-support Pulse Join Safe home equipment have been exploited. There isn’t a proof that Coverage Safe or ZTA gateways have come below in-the-wild abuse.
“Clients ought to monitor their exterior ICT and search for internet server crashes,” Ivanti famous. “In case your ICT outcome exhibits indicators of compromise, you must carry out a manufacturing unit reset on the equipment after which put the equipment again into manufacturing utilizing model 22.7R2.6.”
It is value mentioning right here that Join Safe model 22.7R2.6 additionally addressed a number of essential vulnerabilities (CVE-2024-38657, CVE-2025-22467, and CVE-2024-10644) that would allow a distant authenticated attacker to put in writing arbitrary information and execute arbitrary code.
Google-owned Mandiant, in a bulletin of its personal, mentioned it noticed proof of exploitation of CVE-2025-22457 in mid-March 2025, permitting the menace actors to ship an in-memory dropper referred to as TRAILBLAZE, a passive backdoor codenamed BRUSHFIRE, and the SPAWN malware suite.
The assault chain basically includes using a multi-stage shell script dropper to execute TRAILBLAZE, which then injects BRUSHFIRE straight into the reminiscence of a operating internet course of in an try to sidestep detection. The exploitation exercise is designed to determine persistent backdoor entry on compromised home equipment, doubtlessly enabling credential theft, additional community intrusion, and information exfiltration.
The SPAWN malware ecosystem contains the beneath parts –
- SPAWNSLOTH, a log tampering utility that may disable logging and disable log forwarding to an exterior syslog server when the SPAWNSNAIL backdoor is working
- SPAWNSNARE, a C-based program that is used to extract the uncompressed linux kernel picture (vmlinux) right into a file and encrypt it utilizing AES
- SPAWNWAVE, an improved model of SPAWNANT that mixes numerous parts of SPAWN (overlaps with SPAWNCHIMERA and RESURGE)
The usage of SPAWN is attributed to a China-nexus adversary tracked as UNC5221, which has a historical past of leveraging zero-day flaws in Ivanti Join Safe (ICS) gadgets, alongside different clusters corresponding to UNC5266, UNC5291, UNC5325, UNC5330, UNC5337, and UNC3886.
UNC5221, per the U.S. authorities, has additionally been assessed to share overlaps with menace teams corresponding to APT27, Silk Storm, and UTA0178. Nonetheless, the menace intelligence agency instructed The Hacker Information that it doesn’t have sufficient proof by itself to verify this connection.
“Mandiant tracks UNC5221 as a cluster of exercise that has repeatedly exploited edge gadgets with zero-day vulnerabilities,” Dan Perez, China Mission Technical Lead, Google Risk Intelligence Group, instructed the publication.
“The hyperlink between this cluster and APT27 made by the federal government is believable, however we should not have unbiased proof to verify. Silk Storm is Microsoft’s title for this exercise, and we won’t communicate to their attribution.”
In addition to conducting zero-day exploitation of CVE-2023-4966, affecting Citrix NetScaler gadgets, UNC5221 has leveraged an obfuscation community of compromised Cyberoam home equipment, QNAP gadgets, and ASUS routers to masks their true supply throughout intrusion operations, a side additionally highlighted by Microsoft early final month, detailing Silk Storm’s newest tradecraft.
The corporate additional theorized that the menace actor possible analyzed the February patch launched by Ivanti and discovered a solution to exploit prior variations so as to obtain distant code execution towards unpatched methods. The event marks the primary time UNC5221 has been attributed to the N-day exploitation of a safety flaw in Ivanti gadgets.
“This newest exercise from UNC5221 underscores the continuing focusing on of edge gadgets globally by China-nexus espionage teams,” Charles Carmakal, Mandiant Consulting CTO, mentioned.
“These actors will proceed to analysis safety vulnerabilities and develop customized malware for enterprise methods that do not help EDR options. The speed of cyber intrusion exercise by China-nexus espionage actors continues to extend and these actors are higher than ever.”
