CVE-2024-50317: 
Ivanti Avalanche vulnerability analysis and mitigation

A null pointer dereference vulnerability was identified in Ivanti Avalanche versions prior to 6.4.6. The vulnerability, tracked as CVE-2024-50317, was discovered and reported on September 17, 2024, and publicly disclosed on November 13, 2024. This security flaw affects the WLAvalancheService service, which by default listens on TCP port 1777 (ZDI Advisory).

The vulnerability is classified as a NULL Pointer Dereference (CWE-476) within the WLAvalancheService service. It has been assigned a CVSS v3.1 base score of 7.5 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, indicating that it can be exploited remotely with low attack complexity and requires no privileges or user interaction (NVD).

When successfully exploited, this vulnerability allows remote attackers to create a denial-of-service condition on affected installations of Ivanti Avalanche, potentially disrupting system operations (ZDI Advisory).

Ivanti has released version 6.4.6 of Avalanche to address this vulnerability. Users are advised to update to this version to mitigate the security risk (ZDI Advisory).