CVE-2025-22454
Published: 11 March 2025
Description
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
Security Summary
CVE-2025-22454 involves insufficiently restrictive permissions in Ivanti Secure Access Client versions before 22.7R4. This vulnerability, mapped to CWE-732, enables local privilege escalation and carries a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). It was published on 2025-03-11.
A local authenticated attacker with low privileges can exploit this issue with low complexity and no user interaction required. Successful exploitation allows the attacker to achieve high impacts on confidentiality, integrity, and availability, resulting in privilege escalation on the affected system.
Ivanti has issued a security advisory detailing the vulnerability, available at https://forums.ivanti.com/s/article/March-Security-Advisory-Ivanti-Secure-Access-Client-ISAC-CVE-2025-22454, which provides guidance on mitigation and patching.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Vulnerability enables local privilege escalation via exploitation of weak permissions (CWE-732), directly matching T1068.