"Ivanti's Avalanche MDM Solution Faces Critical Flaws, Warns Company"
Originally Published 1 year ago — by BleepingComputer
Ivanti has issued security updates to address 27 vulnerabilities in its Avalanche mobile device management (MDM) solution, including two critical heap overflows that could allow remote attackers to execute arbitrary commands. The flaws, found in Avalanche's WLInfoRailService and WLAvalancheService components, could be exploited for remote code execution without user interaction. Ivanti also patched 25 medium and high-severity bugs that could lead to denial-of-service attacks, arbitrary command execution, and remote code execution. Customers are urged to update to the latest Avalanche 6.4.3 release to mitigate these security risks.