Friday, 10 January, 2025

Ivanti Faces New Zero-Day Exploits Linked to Nation-State Actors

Ivanti has disclosed a critical zero-day vulnerability, CVE-2025-0282, affecting multiple products, including Connect Secure. Exploited since mid-December 2024, this flaw allows unauthenticated remote code execution, potentially compromising entire networks. Mandiant attributes the attacks to a China-nexus group, UNC5337, possibly linked to previous Ivanti exploits. Ivanti has released patches and urges immediate updates to mitigate risks.