# MA-1303.042025: MyCERT Advisory - Critical Zero-Day in Ivanti Products

**Date:** 06 Apr 2025  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-1303.042025  
**Advisory ID:** MA-1303.042025

---

**1.0 Introduction**
Recently, Ivanti released critical security updates, CVE-2025-22457, affecting multiple products including Ivanti Connect Secure (ICS) VPN appliances, Pulse Connect Secure, Ivanti Policy Secure, and ZTA gateways.
**2.0 Impact**
The flaw is a stack-based buffer overflow that allows unauthenticated remote attackers to achieve remote code execution (RCE).
**3.0 Affected Products**
- Ivanti Connect Secure versions 22.7R2.5 and prior
- Pulse Connect Secure (EoS) versions 9.1R18.9 and prior
- Ivanti Policy Secure versions 22.7R1.3 and prior
- ZTA Gateways versions 22.8R2 and prior
**4.0 Indicator of Compromise (IOCs)**
|  |  | --- | --- | --- | --- | **Code Family** | **MD5** | **Filename** | **Description** | TRAILBLAZE | 4628a501088c31f53b5c9ddf6788e 835 | /tmp/.i | In-memory dropper | BRUSHFIRE | e5192258c27e712c7acf80303e689 80b | /tmp/.r | Passive backdoor | SPAWNSNARE | 6e01ef1367ea81994578526b3bd33 1d6 | /bin/dsma in | Kernel extractor & encryptor | SPAWNWAVE | ce2b6a554ae46b5eb7d79ca5e7f44 0da | /lib/libdsu pgrade.so | Implant utility | SPAWNSLOTH | 10659b392e7f5b30b375b94cae4fd ca0 | /tmp/.libl ogblock.so | Log tampering utility |
**5.0 Recommendations**
CyberSecurity Malaysia encourages users and administrators to review [Ivanti Security Release](https://www.ivanti.com/blog/topics/security-advisory) for more information and apply the necessary updates.
Kindly refer to the following URLs for more information:
- <https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US>
Generally, Cyber999 advises the users of these devices to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, please contact Cyber999 Incident Response Centre through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours) 
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 08:30 -17:30 MYT 
Web: [https://www.mycert.org.my](https://www.mycert.org.my/)
**5.0 References**
- <https://www.ivanti.com/blog/topics/security-advisory>
- <https://forums.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US>
- <https://cloud.google.com/blog/topics/threat-intelligence/china-nexus-exploiting-critical-ivanti-vulnerability/>