The Front Door Was Broken: Ivanti ICS and Patching as Remediation

Beginning in 2023, Ivanti reported vulnerabilities in their Ivanti Connect Secure (ICS), which sits in front of internal networks handling VPN access, authentication, policy enforcement, and session management.  Ivanti reported an “authentication bypass vulnerability in the web component,” where code in the web interface, which was supposed to check whether a user is already logged in, can be skipped (CVE 2023-46805, CVSS 8.2).  ICS had a vulnerability at its front door.  Later, in 2024, a second ICS vulnerability was described where a command injection vulnerability allows an authenticated administrator to send requests which execute arbitrary commands on the ICS appliance (CVE 2024-21887, CVSS 9.1).  Combined, CVE 2023-46805 and CVE 2024-21887, allow a non-authenticated threat actor to craft malicious requests and execute arbitrary requests on the system.  CVE 2023-46805 lets a bad actor pretend to be authenticated, and CVE 2024-21887 lets the “authenticated user” run OS commands.  Wonderful.

In case the gravity hasn’t landed yet, the CVSS scores, 8.2 and 9.1 respectively, warn of high severity, and the CVSS vector, AV:N/AC:L/PR:N/UI:N (partial), translates to: reachable over the internet, easy to exploit, no privileges required, and no user interaction (for CVE 2023-46805).  This isn’t a patch bug, its full system compromise of a trusted device which can drop web shells, modify binaries, exfiltrate credentials, and disable logging.  Good times.Now, lets escalate.  In April 2025 Ivanti reports a “security advisory,” which is assigned a CVSS of 9, and allows a malicious attacker to exploit a stack-based buffer overflow permitting the unauthenticated attacker to execute remote code execution.  I need to say this again: “a stack-based buffer overflow.”  Ivanti describes this as “advisory,” “limited number of customers,” “reduced risk,” and if you read their reporting further, “a production bug.”  Despite the vendor “advisory” language attempting to mitigate the blast radius and panic of, again, “a stack-based buffer overflow” the last characterization as “a production bug,” is most telling.  The bug existed much earlier.  As Ivanti states, “The vulnerability is a buffer overflow with characters limited to periods and numbers… initially determined not exploitable as RCE.”  Interpreting vendor speak, the bug existed at the beginning, it was known, it was misclassified, and it was assumed safe, now run this new patch and everything will be fine.Putting it all together, Ivanti’s disclosures imply that ICS was shipped with a fundamental flaw at production.  In 2023 authentication controls could be bypassed, in 2024 command execution could be abused, and in 2025 it was revealed a stack-based buffer overflow had existed all along but was misclassified as non-exploitable.   I’m working on thinking of this in layers.  At Layer 1, ICS as a perimeter trust authenticator, and In the 2023 CVE, we see incorrect trust boundary and concentration of privilege at that single boundary or control plane.  Thus, CVE 2023-46805, the authentication bypass vulnerability, lacks defense-in-depth at the front door of the appliance. 

Layer 2, as I see it, is the 2025 CVE, the stack-buffer overflow, where unsafe code in a network-facing service could be exploited.  CVE-2025-22457, at Layer 2 in my model, is secure implementation.  Ivanti failed to use secure code standards, memory safety guarantees, and resilient design.  Next, Layer 3, this is the failure to assess risk of the stack-buffer overflow vulnerability where a known flaw was downgraded bused on an assumption (only periods and numbers could be sent as input) which was later proven to be insufficient.  At Layer 3, we see inadequate threat modeling, and the minimizations found in their reporting don’t match the severity of the vulnerabilities.

This brings me to the final layer, Layer 4, which I see this as the ‘once trust is violated, how do I trust you again’ question.  Trust was violated at the front door, at authentication.  ICS was the bouncer who checked IDs before the manager (Ivanti’s Integrity Checker—ICT) ever saw the traffic.  Boundary enforcement was compromised.  Now the manager, Ivanti’s own ICT is checking integrity, good, but it is only checking what it knows how to check.  ICT looks for modified files, known indicators, artifacts of IoC patterns and past compromises.  So, a potentially compromised system is self-reporting its own compromise.  Has the attacker influenced the integrity report?  We don’t know.  Ivanti’s response in 2025 was to rely on a patch released in February 2025 and a forthcoming patch on April 19, 2025.  This is a mismatch in both timing and trust.  The vulnerabilities and possible exploitation(s) existed and occurred pre-patch.  Nothing about patching on April 19, 2025, remediates exploitation risk and the trust impact which began, or at least were first reported, as early as 2023.  Further, nothing about the patched system validates trust of the system at time of path or after.  Are attackers who utilized the previous exploits still on the system?  What was exfiltrated?  What is the visible behavior of attackers exploiting ICS?  Again, we don’t know, and we have no assurance the patch remedies trusted ownership.  I believe patching as implemented by Ivanti is a policy decision not a technical remediation of trust.  I’ve asked several questions critiquing Ivanti’s patching as remediation, I’d summarize this as follows: Patching fixes the bug, but it does not answer the only question that matters after a perimeter compromise: can this device still be trusted?

References

Ivanti. CVE-2023-46805 Authentication Bypass & CVE-2024-21887 Command Injection for Ivanti Connect Secure and Ivanti Policy Secure Gateways. Ivanti, https://hub.ivanti.com/s/article/CVE-2023-46805-Authentication-Bypass-CVE-2024-21887-Command-Injection-for-Ivanti-Connect-Secure-and-Ivanti-Policy-Secure-Gateways?language=en_US. Accessed 9 Feb. 2026.Ivanti. April Security Advisory: Ivanti Connect

Secure, Policy Secure & ZTA Gateways (CVE-2025-22457). Ivanti, https://hub.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457?language=en_US. Accessed 9 Feb. 2026.