Description
Pulse Secure Pulse Connect Secure（又名PCS，前称Juniper Junos Pulse）是美国Pulse Secure公司的一套SSL VPN解决方案。 Pulse Connect Secure 9.1R8.2之前版本中存在代码注入漏洞。该漏洞源于外部输入数据构造代码段的过程中，网络系统或产品未正确过滤其中的特殊元素。攻击者可利用该漏洞生成非法的代码段，修改网络系统或组件的预期的执行控制流。
Ivanti Pulse Connect Secure VPN 存在远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://www.anquanke.com/post/id/306229
https://x.threatbook.com/v5/article?threatInfoID=100828
https://stack.chaitin.com/vuldb/detail/a7926f20-4907-418e-a466-2114933f5258
https://hub.ivanti.com/s/article/April-Security-Advisory-Ivanti-Connect-Secure-Policy-Secure-ZTA-Gateways-CVE-2025-22457
https://www.rapid7.com/blog/post/2025/04/03/etr-ivanti-connect-secure-cve-2025-22457-exploited-in-the-wild/
https://kudelskisecurity.com/research/critical-ivanti-connect-secure-vulnerability
https://bestwing.me/CVE-2025-0282-Ivanti-Connect-Secure-VPN-stack-overflow.html
https://www.volexity.com/blog/2024/01/10/active-exploitation-of-two-zero-day-vulnerabilities-in-ivanti-connect-secure-vpn/
https://arcticwolf.com/resources/blog-uk/cve-2025-22457-ivanti-connect-secure-vpn-vulnerable-to-zero-day-rce-exploitation/
https://cloud.google.com/blog/topics/threat-intelligence/ivanti-connect-secure-vpn-zero-day