Introduction
A read-only admin account should not be able to change a system's configuration. When it can, it can undermine a network's whole security posture. CVE-2025-55148 is a high-severity missing authorization vulnerability in Ivanti Connect Secure, Policy Secure, ZTA Gateway, and Neurons for Secure Access. It breaks a core access control boundary in these enterprise products, the line between read-only and full administrators.
Ivanti is a major vendor of enterprise security and IT management software. Its products are widely deployed in critical infrastructure, healthcare, finance, and government. Because the customer base is large and the network security product line is broad, a vulnerability in Ivanti products can have an impact across many industries.
Technical Information
CVE-2025-55148 comes from insufficient authorization checks in the administrative interfaces of several Ivanti products. A remote authenticated user with read-only admin privileges can make configuration changes that should be restricted to higher-privilege accounts. It is a classic case of CWE-862: the software authenticates the user but does not properly enforce authorization boundaries afterwards.
An attacker needs network access to the admin interface, typically through the web-based management portals or protocol endpoints. The server-side logic does not correctly distinguish between read-only and full admin privileges when it processes configuration change requests. An attacker holding read-only admin credentials can therefore submit requests that change restricted settings, which leads to privilege escalation or unauthorized modifications.
No public code snippets or proof of concept have been released. The likely cause is inconsistent or missing server-side authorization logic across different code paths in the affected products.
Affected Systems and Versions
- Ivanti Connect Secure before 22.7R2.9 or 22.8R2
- Ivanti Policy Secure before 22.7R1.6
- Ivanti ZTA Gateway before 2.8R2.3-723
- Ivanti Neurons for Secure Access before 22.8R1.4
Any configuration is vulnerable if it has read-only admin accounts and those accounts have network access to the admin interface.
Vendor Security History
Ivanti has faced multiple critical vulnerabilities in 2025, including:
- CVE-2025-22457 (stack-based buffer overflow in Connect Secure, initially misclassified as low risk)
- CVE-2025-4427 and CVE-2025-4428 (Endpoint Manager Mobile)
- CVE-2025-5456 and CVE-2025-5462 (buffer over-read and heap buffer overflow)
Ivanti's patch response has improved, but the company has misclassified vulnerabilities in the past, and that delayed remediation. Its products remain high-value targets for advanced threat actors, especially those after privilege escalation and persistent access.
