Connect with us

Hi, what are you looking for?



Ivanti Patches 27 Vulnerabilities in Avalanche MDM Product

Ivanti releases patches for 27 vulnerabilities in the Avalanche MDM product, including critical flaws leading to command execution.

IT software company Ivanti on Tuesday announced fixes for 27 vulnerabilities in its Avalanche enterprise mobile device management (MDM) product, including two critical-severity bugs leading to command execution.

The two critical flaws, tracked as CVE-2024-24996 and CVE-2024-29204, are described as heap overflow issues in the WLInfoRailService and WLAvalancheService components of the MDM solution.

Both vulnerabilities, Ivanti notes in its advisory, can be exploited remotely, without authentication, and have a CVSS score of 9.8.

The Avalanche security patches also address multiple high-severity vulnerabilities that could allow remote, unauthenticated attackers to execute commands with System privileges.

Eight of these are described as path traversal issues in the web component of Ivanti Avalanche. An unrestricted file upload bug and two race condition (TOCTOU) vulnerabilities in the web component could also be exploited for command execution as System.

Ivanti also resolved a high-severity heap overflow bug in the WLInfoRailService component that could be exploited remotely and without authentication to execute commands, and a high-severity use-after-free issue in WLAvalancheService leading to remote code execution (RCE).

The updates also address several high-severity flaws leading to denial-of-service (DoS), and medium-severity issues allowing unauthenticated remote attackers to read sensitive information in memory.

According to Ivanti, none of the resolved vulnerabilities have been exploited in the wild. Other Ivanti products are not affected by these security defects.

Advertisement. Scroll to continue reading.

The software company patched all flaws with version 6.4.3 of the Ivanti Avalanche on-premises product. According to Ivanti, all supported versions of the MDM solution (versions 6.3.1 and above) are affected, and older releases might also be at risk.

Ivanti customers are advised to update their Avalanche installations as soon as possible. Attackers are known to have exploited flaws in Ivanti products, including bugs for which patches have been released.

Related: Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability

Related: Ivanti Patches Critical Vulnerabilities in Standalone Sentry, Neurons for ITSM

Related: Chinese Cyberspies Use New Malware in Ivanti VPN Attacks

Written By

Ionut Arghire is an international correspondent for SecurityWeek.


Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join the session as we discuss the challenges and best practices for cybersecurity leaders managing cloud identities.


The AI Risk Summit brings together security and risk management executives, AI researchers, policy makers, software developers and influential business and government stakeholders.


People on the Move

Fastly announced that Scott Lovett will join the company as Chief Revenue Officer, effective June 3, 2024.

Digital transformation consulting firm Synechron has hired Aaron Momin as CISO.

Wendy Zheng named as CFO and Joe Diamond as CMO at cyber asset management firm Axonius.

More People On The Move

Expert Insights