Cyb3rius
@cyb3rius
· 5d
How are attackers chaining Ivanti Connect Secure flaws to get root?Attackers are chaining three separate Ivanti Connect Secure vulnerabilities in sequence, moving from unauthenticated outsider to full root on the appliance. No credentials are required at the start of the chain.What happened: The U.S. Cybersecurity and Infrastructure Security Agency added two Ivanti Connect Secure flaws to its Known Exploited Vulnerabilities catalog on Friday, after researchers demonstrated a three-bug exploit chain ending in unauthenticated root access. The chain includes CVE-2025-0282, a stack-based buffer overflow in the ICS integrity checker rated 9.0, paired with a privilege-escalation step. Ivanti has issued fixes, and CISA is directing federal agencies to patch on a compressed deadline.Key numbers: 3 flaws chained to reach rootCVSS 9.0 severity for CVE-2025-02822 ICS flaws added to the KEV catalogWhy it matters: Connect Secure sits directly on the network edge, so a rooted appliance gives attackers a trusted, encrypted foothold for lateral movement that defenders rarely inspect.Bottom line: An edge device is only as strong as the weakest link in its exploit chain, so patch first and assume compromise second.
0