CVE-2024-23527: 
Ivanti Avalanche vulnerability analysis and mitigation

CVE-2024-23527 is an out-of-bounds read vulnerability discovered in the WLAvalancheService component of Ivanti Avalanche versions prior to 6.4.3. The vulnerability was disclosed in April 2024 and affects the Ivanti Avalanche mobile device management system (ZDI Advisory, NVD).

The vulnerability exists within the WLAvalancheService, which listens on TCP port 1777 by default. The specific flaw results from the lack of proper validation of user-supplied data, which can lead to a read past the end of an allocated buffer. The vulnerability has been assigned a CVSS v3.0 base score of 5.3 (Medium) with the vector string CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N (ZDI Advisory).

When successfully exploited, this vulnerability allows an unauthenticated remote attacker to read sensitive information in memory. The attacker can leverage this vulnerability in conjunction with other vulnerabilities to potentially execute arbitrary code in the context of SYSTEM (ZDI Advisory).

Currently, there are no reports of this vulnerability being exploited in the wild. The vulnerability can be exploited remotely by an unauthenticated attacker (CIS Advisory).

Ivanti has released version 6.4.3 to address this vulnerability. Organizations using affected versions of Ivanti Avalanche should upgrade to version 6.4.3 immediately after appropriate testing (Ivanti Blog).