CVE-2025-0282: Ivanti Connect Secure and the Edge-Device Problem

January 2025 opened with another edge-device zero-day. Ivanti disclosed CVE-2025-0282, a critical stack-based buffer overflow in Connect Secure, Policy Secure, and related gateways, that was already being exploited in the wild. It joins a long run of VPN and firewall appliances targeted by capable actors over the past two years.

Why attackers love the edge

Internet-facing appliances are attractive because they sit at the network boundary, often run opaque firmware, and are difficult to inspect with standard endpoint tooling. A successful exploit can yield a foothold with broad reach and few eyes watching. Once inside, adversaries have repeatedly deployed web shells and credential harvesters, then moved laterally.

The pattern across vendors

• Pre-authentication vulnerabilities that need no credentials.
• Exploitation observed before or alongside public disclosure.
• Persistence that can survive naive patching if the device was already compromised.

That last point is the trap. Applying a patch does not remove an implant that was installed beforehand.

What to do now

• Patch urgently and follow the vendor’s integrity checks to confirm the device was not already breached.
• Rotate secrets stored on or reachable from the device, including certificates, API keys, and service account passwords.
• Reduce exposure by restricting management interfaces to trusted networks and disabling unused features.

Takeaway

Edge devices are now a primary target, not an afterthought. Patch fast, verify integrity because patching alone does not evict an existing intruder, rotate anything the device could have exposed, and shrink your attack surface before the next advisory lands.