CVE-2025-55146
Full vulnerability record from the local CVENow database.
Description
An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service.
Severity
MEDIUM
CVSS score
4.9
(v3.1)
Vulnerability status
Analyzed
Source identifier
3c1d8aa1-5a33-4ea4-8992-aadd6440af75
Published
2025-09-09 16:15:34.890000
Last modified
2026-10-18 21:10:00.120000
View original CVE JSON
{
"id": "CVE-2025-55146",
"sourceIdentifier": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"published": "2025-09-09T16:15:34.890",
"lastModified": "2026-10-18T21:10:00.120",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "An unchecked return value in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a remote authenticated attacker with admin privileges to trigger a denial of service."
},
{
"lang": "es",
"value": "Un valor de retorno no verificado en Ivanti Connect Secure anterior a 22.7R2.9 o 22.8R2, Ivanti Policy Secure anterior a 22.7R1.6, Ivanti ZTA Gateway anterior a 2.8R2.3-723 e Ivanti Neurons for Secure Access anterior a 22.8R1.4 (Corrección implementada el 02-ago-2025) permite a un atacante remoto autenticado con privilegios de administrador activar una denegación de servicio."
}
],
"affected": [
{
"source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"affectedData": [
{
"vendor": "Ivanti",
"product": "Connect Secure",
"defaultStatus": "affected",
"versions": [
{
"version": "22.7R2.9",
"status": "unaffected"
},
{
"version": "22.8R2",
"status": "unaffected"
}
]
},
{
"vendor": "Ivanti",
"product": "Policy Secure",
"defaultStatus": "affected",
"versions": [
{
"version": "22.7R1.6",
"status": "unaffected"
}
]
},
{
"vendor": "Ivanti",
"product": "ZTA Gateway",
"defaultStatus": "affected",
"versions": [
{
"version": "2.8R2.3-723",
"status": "unaffected"
}
]
},
{
"vendor": "Ivanti",
"product": "Neurons for Secure Access",
"defaultStatus": "affected",
"versions": [
{
"version": "22.8R1.4 (Fix deployed on 02-Aug-2025)",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"type": "Secondary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 4.9,
"baseSeverity": "MEDIUM",
"attackVector": "NETWORK",
"attackComplexity": "LOW",
"privilegesRequired": "HIGH",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.2,
"impactScore": 3.6
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"timestamp": "2025-09-09T16:05:43.077332Z",
"id": "CVE-2025-55146",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
]
},
"weaknesses": [
{
"source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"type": "Secondary",
"description": [
{
"lang": "en",
"value": "CWE-252"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.7",
"matchCriteriaId": "201EB882-0B2A-47DB-B517-1E72A0542B27"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*",
"matchCriteriaId": "F788F6D9-5368-4B8E-BFA0-E8FB3CDADB01"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*",
"matchCriteriaId": "2927A40D-E8A3-4DB6-9C93-04A6C6035C3D"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*",
"matchCriteriaId": "1399BBB4-E62B-4FF6-B9E3-6AAC68D4D583"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "1EAD1423-4477-4C35-BF93-697A2C0697C6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*",
"matchCriteriaId": "858353BC-12CB-4014-BFCA-DA7B1B3DD4B9"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*",
"matchCriteriaId": "865F72BF-57B2-4B0C-BACE-3500E0AE6751"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*",
"matchCriteriaId": "39E11407-E0C0-454F-B731-7DA4CBC696EB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*",
"matchCriteriaId": "247E71F8-A03B-4097-B7BF-09F8BF3ED4D6"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*",
"matchCriteriaId": "E0059C69-4A18-4153-9D9A-5C1B03AD1453"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*",
"matchCriteriaId": "FC523C88-115E-4CD9-A8CB-AE6E6610F7D4"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*",
"matchCriteriaId": "3447428E-DBCD-4553-B51D-AC08ECAFD881"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*",
"matchCriteriaId": "A08BAF98-7F05-4596-8BFC-91F1A79D3BD1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.5:*:*:*:*:*:*",
"matchCriteriaId": "40717D97-A062-49C4-B105-C22AAC3A206A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.6:*:*:*:*:*:*",
"matchCriteriaId": "C3019D80-C578-437E-A304-F49F1AEC24F1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.7:*:*:*:*:*:*",
"matchCriteriaId": "A2EFC001-63D4-4FD0-8E14-C5A1C9E3BF9C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:connect_secure:22.7:r2.8:*:*:*:*:*:*",
"matchCriteriaId": "5100B9BD-3C11-4C22-9A5E-2FBFD06701EA"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.7",
"matchCriteriaId": "FAD0FC91-CA1E-4DC3-A37E-1BF98906D07C"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*",
"matchCriteriaId": "1F22B988-2585-4853-9838-AB3746C8B888"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*",
"matchCriteriaId": "FD9BE8C2-43EB-4870-A4B7-267CB17A19F1"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*",
"matchCriteriaId": "C8915BB2-C1C0-4189-A847-DDB2EF161D62"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "8D24A8DB-D697-4C60-935D-B08EE36861CB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.3:*:*:*:*:*:*",
"matchCriteriaId": "4C12D325-77E1-4873-8A77-D76F4A73BCF8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.4:*:*:*:*:*:*",
"matchCriteriaId": "95E4AE0D-614C-4300-9ADB-8442EF9A84C5"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:policy_secure:22.7:r1.5:*:*:*:*:*:*",
"matchCriteriaId": "7E6DEE21-6940-47B5-8733-B0C5BC045858"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:zero_trust_access_gateway:22.8:r2.2:*:*:*:*:*:*",
"matchCriteriaId": "E7C3FC1D-94CA-4594-ABF3-59829E43A692"
}
]
}
]
},
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:*:*:*:*:*:*:*:*",
"versionEndExcluding": "22.8",
"matchCriteriaId": "7705B778-27AA-45D2-966E-2E5BE7CDC022"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1:*:*:*:*:*:*",
"matchCriteriaId": "A32A3778-B33F-4249-A248-745876B4CE48"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.1:*:*:*:*:*:*",
"matchCriteriaId": "B415A830-5771-462F-8E55-790FFF7D5277"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.2:*:*:*:*:*:*",
"matchCriteriaId": "E79007DD-C9A9-4DE8-AD06-FB5F9BAC4EBB"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.3:*:*:*:*:*:*",
"matchCriteriaId": "003B96FC-A3C7-4488-B0D0-7F7EFD9C762F"
}
]
}
]
}
],
"references": [
{
"url": "https://forums.ivanti.com/s/article/September-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-and-Neurons-for-Secure-Access-Multiple-CVEs?language=en_US",
"source": "3c1d8aa1-5a33-4ea4-8992-aadd6440af75",
"tags": [
"Vendor Advisory"
]
}
]
}