Vulnerability details
| CVE | CVSS | EPSS | KEV | PoC | PRS risk |
|---|---|---|---|---|---|
| CVE-2025-0282 | 9.0 | 100.0% | ✅ listed | available | 86.5 (Critical) |
Two parallel campaigns scanning Ivanti for CVE-2025-0282
GreyNoise Labs has observed more than 34,000 active sessions across two parallel scanning campaigns targeting Ivanti Connect Secure for CVE-2025-0282, representing a 100x spike over the provider’s baseline traffic.
Both campaigns are hunting the same vulnerability: a stack-based buffer overflow in Ivanti Connect Secure prior to version 22.7R2.5 that allows a remote unauthenticated attacker to achieve code execution. The CVE carries a CVSS 3.1 score of 9.0, an EPSS score of 100.0% (100th percentile), is listed in CISA’s Known Exploited Vulnerabilities catalog, and has a public proof-of-concept available.
Campaign 1 is the high-volume cluster, concentrated in AS213790 operated by Limited Network LTD. The geographic footprint is clustered in Romania and Moldova, a pattern consistent with the provider’s prior reconnaissance work. The burst pattern suggests automated tooling running at full throttle, likely racing to enumerate targets before patches deploy.
Campaign 2 takes the distributed approach: roughly 6,000 unique IPs spread across multiple ASNs and geographies, with no single provider dominating the traffic. The distribution is consistent with botnet infrastructure, residential proxy networks, or multi-cloud deployment. Pacing is lower and steadier than Campaign 1, indicating a different operator profile.
The AS213790 cluster: Limited Network LTD in Romania/Moldova
The high-volume cluster sits in AS213790, operated by Limited Network LTD, a recurring recon provider that has appeared in prior scanning campaigns. The geographic footprint is concentrated in Romania and Moldova, a pattern consistent with the provider’s prior work. The burst pattern indicates automated tooling running at full throttle, likely racing to enumerate targets before patches deploy.
The distributed campaign: 6,000 IPs across multiple ASNs
Campaign 2 takes the distributed approach: roughly 6,000 unique IPs spread across multiple ASNs and geographies, with no single provider dominating the traffic. The distribution is consistent with botnet infrastructure, residential proxy networks, or multi-cloud deployment. Pacing is lower and steadier than Campaign 1, indicating a different operator profile.
CVE-2025-0282: stack-based buffer overflow in Ivanti Connect Secure
Ivanti has assigned CVE-2025-0282 to a stack-based buffer overflow in Connect Secure, Policy Secure, and Neurons for ZTA gateways. The flaw affects Connect Secure versions prior to 22.7R2.5, Policy Secure before 22.7R1.2, and Neurons for ZTA before 22.7R2.3. A remote unauthenticated attacker can trigger the overflow to achieve code execution on the gateway.
The vulnerability carries a CVSS 3.1 score of 9.0, an EPSS score of 100.0% at the 100th percentile, and is listed in CISA’s Known Exploited Vulnerabilities catalog. A public proof-of-concept is available. The PRS risk score sits at 86.5 (Critical), and 11 products are affected.
What to look for in logs and network exposure
External requests to /dana-na/auth/url_default/welcome.cgi deserve scrutiny. That endpoint is the unauthenticated entry point for the stack-based buffer overflow, and it is the path the scanner hits first. If you see it in your access logs from an IP that is not your own, you have a candidate for CVE-2025-0282.
Every internet-facing Ivanti instance is potentially on a target list. The AS213790 cluster is running at full throttle, which means the operator is enumerating before the patch window closes. If your Connect Secure is still on 22.7R2.4 or earlier, the overflow is live. The EPSS at 100.0% and the KEV listing confirm the exploit is in the wild, not just in the lab.
Patch status matters now. Exploitation is a matter of when, not if. The CVSS 9.0 and the public PoC mean the RCE is trivial to trigger once the request lands. If you are not on 22.7R2.5 for Connect Secure, 22.7R1.2 for Policy Secure, or 22.7R2.3 for Neurons for ZTA, you are in the 11 affected products. The PRS risk at 86.5 (Critical) reflects the unauthenticated remote code execution on the gateway.
Key points
- Two parallel campaigns generated 34k+ sessions with a 100x baseline spike scanning for CVE-2025-0282.
- Campaign 1 (high-volume) is concentrated in AS213790 operated by Limited Network LTD, geographically clustered in Romania and Moldova.
- Campaign 2 (distributed) uses ~6,000 unique IPs across multiple ASNs and geographies, consistent with botnet, residential proxies, or multi-cloud deployment.
- CVE-2025-0282 is a stack-based buffer overflow in Ivanti Connect Secure < 22.7R2.5, Policy Secure < 22.7R1.2, and Neurons for ZTA < 22.7R2.3 allowing unauthenticated RCE (CVSS 9.0, EPSS 100%, KEV, PoC available).
- Exploit path is /dana-na/auth/url_default/welcome.cgi; every internet-facing Ivanti instance is a target until patched.