CVE-2025-22454

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2025-22454
Insufficiently restrictive permissions in Ivanti Secure Access Client before 22.7R4 allows a local authenticated attacker to escalate their privileges.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://forums.ivanti.com/s/article/March-Security-Advisory-Ivanti-Secure-Access-Client-ISAC-CVE-2025-22454 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:ivanti:secure_access_client:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:r3:*:*:*:*:*:*
History

16 Jul 2025, 15:25

Type Values Removed Values Added
CPE cpe:2.3:a:ivanti:secure_access_client:22.7:r1.1:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:-:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:r2:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:r1:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:*:*:*:*:*:*:*:*
cpe:2.3:a:ivanti:secure_access_client:22.7:r3:*:*:*:*:*:*
Summary
  • (es) Los permisos insuficientemente restrictivos en Ivanti Secure Access Client anterior a 22.7R4 permiten que un atacante local autenticado aumente sus privilegios.
References () https://forums.ivanti.com/s/article/March-Security-Advisory-Ivanti-Secure-Access-Client-ISAC-CVE-2025-22454 - () https://forums.ivanti.com/s/article/March-Security-Advisory-Ivanti-Secure-Access-Client-ISAC-CVE-2025-22454 - Vendor Advisory
First Time Ivanti secure Access Client
Ivanti

11 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-11 15:15

Updated : 2025-07-16 15:25

NVD link : CVE-2025-22454

Mitre link : CVE-2025-22454

CVE.ORG link : CVE-2025-22454

JSON object : View

Products Affected

ivanti

  • secure_access_client
CWE
CWE-732

Incorrect Permission Assignment for Critical Resource