CVE-2025-0282 is an unauthenticated stack-based buffer overflow in Ivanti Connect Secure, Policy Secure, and ZTA Gateways enabling remote code execution. Mandiant identified zero-day exploitation beginning mid-December 2024 by UNC5221/UNC5337 (China-nexus espionage). Ivanti disclosed 8 January 2025 with a patch. Post-exploitation chain: disable SELinux, prevent syslog forwarding, remount filesystem read-write, drop webshells, remove log evidence, deploy SPAWN malware ecosystem. 33,000+ exposed ICS instances globally at time of disclosure. CISA added to KEV catalog. Predecessor campaigns by UNC5221 also exploited CVE-2023-46805 and CVE-2024-21887 in December 2023.