SB2025081240 - Multiple vulnerabilities in Ivanti Connect Secure and Policy Secure

Description

This security bulletin contains information about 4 secuirty vulnerabilities.

1) Out-of-bounds read (CVE-ID: CVE-2025-5456)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a boundary condition. A remote attacker can send specially crafted requests to the system, trigger an out-of-bounds read error and perform a denial of service (DoS) attack.

2) NULL pointer dereference (CVE-ID: CVE-2025-5462)

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to a NULL pointer dereference error. A remote attacker can send specially crafted packets to the system and perform a denial of service (DoS) attack.

3) XML Entity Expansion (CVE-ID: CVE-2025-5466)

The vulnerability allows a remote user to perform a denial of service attack.

The vulnerability exists due to insufficient input validation when handling XML data. A remote user with admin privileged can perform a denial of service (DoS) attack.

4) Link following (CVE-ID: CVE-2025-5468)

The vulnerability allows a local user to read arbitrary files on the system.

The vulnerability exists due to an insecure link following issue. A local user can create a specially crafted symbolic link to a critical file on the system and read its contents.

Remediation

Install update from vendor's website.

References

• https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US&_gl=1*1qbb10c*_gcl_au*MTc4NjkyNzMyNC4xNzQ5NTY4MTAy