CVE-2025-5468

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-5468
Improper handling of symbolic links in Ivanti Connect Secure before version 22.7R2.8 or 22.8R2, Ivanti Policy Secure before 22.7R1.5, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivanti Neurons for Secure Access before 22.8R1.4 (Fix deployed on 02-Aug-2025) allows a local authenticated attacker to read arbitrary files on disk.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.6:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.7:*:*:*:*:*:*

Configuration 2 (hide)

OR cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1.4:*:*:*:*:*:*

Configuration 3 (hide)

cpe:2.3:a:ivanti:zero_trust_access_gateway:22.8:r2.2:*:*:*:*:*:*

Configuration 4 (hide)

OR cpe:2.3:a:ivanti:neurons_for_secure_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.3:*:*:*:*:*:*
History

23 Sep 2025, 18:17

Type Values Removed Values Added
References () https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US - () https://forums.ivanti.com/s/article/August-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-Multiple-CVEs?language=en_US - Vendor Advisory
First Time Ivanti neurons For Secure Access
Ivanti connect Secure
Ivanti
Ivanti policy Secure
Ivanti zero Trust Access Gateway
CPE cpe:2.3:a:ivanti:connect_secure:22.7:r2.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.6:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.5:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.7:*:*:*:*:*:*
cpe:2.3:a:ivanti:neurons_for_secure_access:22.8:r1.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.3:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:zero_trust_access_gateway:22.8:r2.2:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:connect_secure:22.7:r2.4:*:*:*:*:*:*
cpe:2.3:a:ivanti:policy_secure:22.7:-:*:*:*:*:*:*

13 Aug 2025, 17:34

Type Values Removed Values Added
Summary
  • (es) El manejo inadecuado de enlaces simbólicos en Ivanti Connect Secure anterior a la versión 22.7R2.8 o 22.8R2, Ivanti Policy Secure anterior a 22.7R1.5, Ivanti ZTA Gateway anterior a 22.8R2.3-723 y Ivanti Neurons for Secure Access anterior a 22.8R1.4 (corrección implementada el 02-ago-2025) permite que un atacante autenticado local lea archivos arbitrarios en el disco.

12 Aug 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-08-12 15:15

Updated : 2025-09-23 18:17

NVD link : CVE-2025-5468

Mitre link : CVE-2025-5468

CVE.ORG link : CVE-2025-5468

JSON object : View

Products Affected

ivanti

  • policy_secure
  • zero_trust_access_gateway
  • connect_secure
  • neurons_for_secure_access
CWE
CWE-61

UNIX Symbolic Link (Symlink) Following