IT software company Ivanti on Tuesday announced fixes for 27 vulnerabilities in its Avalanche enterprise mobile device management (MDM) product, including two critical-severity bugs leading to command execution.
The two critical flaws, tracked as CVE-2024-24996 and CVE-2024-29204, are described as heap overflow issues in the WLInfoRailService and WLAvalancheService components of the MDM solution.
Both vulnerabilities, Ivanti notes in its advisory, can be exploited remotely, without authentication, and have a CVSS score of 9.8.
The Avalanche security patches also address multiple high-severity vulnerabilities that could allow remote, unauthenticated attackers to execute commands with System privileges.
Eight of these are described as path traversal issues in the web component of Ivanti Avalanche. An unrestricted file upload bug and two race condition (TOCTOU) vulnerabilities in the web component could also be exploited for command execution as System.
Ivanti also resolved a high-severity heap overflow bug in the WLInfoRailService component that could be exploited remotely and without authentication to execute commands, and a high-severity use-after-free issue in WLAvalancheService leading to remote code execution (RCE).
The updates also address several high-severity flaws leading to denial-of-service (DoS), and medium-severity issues allowing unauthenticated remote attackers to read sensitive information in memory.
According to Ivanti, none of the resolved vulnerabilities have been exploited in the wild. Other Ivanti products are not affected by these security defects.
The software company patched all flaws with version 6.4.3 of the Ivanti Avalanche on-premises product. According to Ivanti, all supported versions of the MDM solution (versions 6.3.1 and above) are affected, and older releases might also be at risk.
Ivanti customers are advised to update their Avalanche installations as soon as possible. Attackers are known to have exploited flaws in Ivanti products, including bugs for which patches have been released.
Related: Thousands of Ivanti VPN Appliances Impacted by Recent Vulnerability
Related: Ivanti Patches Critical Vulnerabilities in Standalone Sentry, Neurons for ITSM
Related: Chinese Cyberspies Use New Malware in Ivanti VPN Attacks
