[MàJ] Vulnérabilité dans les produits Ivanti

{
  "id": "3affaa59ed303d643af4d4c4b7f851e2f7c0656c691760521ba2038ebab05a21",
  "url": "https://www.cert.ssi.gouv.fr/alerte/CERTFR-2025-ALE-001/",
  "method": "llm",
  "payload": {
    "kind": "patch",
    "title": "[MàJ] Vulnérabilité dans les produits Ivanti",
    "summary": "The bulletin lists Connect Secure 22.7R2.5 as the threshold after affected versions and describes CVE-2025-0282 as allowing unauthenticated remote code execution. Fixes for Policy Secure and Neurons for ZTA gateways were announced as forthcoming.",
    "evidence": "Cette vulnérabilité, d'identifiant CVE-2025-0282, permet à un attaquant non authentifié de provoquer une exécution de code arbitraire à distance.",
    "products": [
      {
        "name": {
          "value": "Connect Secure (ICS)",
          "evidence": "Connect Secure (ICS) versions 22.7R2.x antérieures à 22.7R2.5"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "22.7R2.5",
            "evidence": "Connect Secure (ICS) versions 22.7R2.x antérieures à 22.7R2.5"
          }
        ],
        "affected_versions": [
          {
            "value": "22.7R2.x antérieures à 22.7R2.5",
            "evidence": "Connect Secure (ICS) versions 22.7R2.x antérieures à 22.7R2.5"
          }
        ]
      },
      {
        "name": {
          "value": "Neurons for ZTA gateways",
          "evidence": "Neurons for ZTA gateways versions 22.7R2.x antérieures à 22.7R2.5"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "22.7R2.x antérieures à 22.7R2.5",
            "evidence": "Neurons for ZTA gateways versions 22.7R2.x antérieures à 22.7R2.5"
          }
        ]
      },
      {
        "name": {
          "value": "Policy Secure (IPS)",
          "evidence": "Policy Secure (IPS) toutes versions 22.7R1.x"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "toutes versions 22.7R1.x",
            "evidence": "Policy Secure (IPS) toutes versions 22.7R1.x"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2025-0282",
        "evidence": "Cette vulnérabilité, d'identifiant CVE-2025-0282"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-cert-fr-alerts",
  "document_id": 23296,
  "published_at": "2025-01-09T00:00:00+00:00"
}