critical9.8Public exploit code
CVE-2023-32560
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Ivanti Avalanche <v6.4.0.0 - Remote Code Execution2023-09-04 · remote · windows
Impact
An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in service disruption or arbitrary code execution. Thanks to a Researcher at Tenable for finding and reporting. Fixed in version 6.4.1.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Ivanti | Avalanche | before 6.4.1 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/174459/Ivanti-Avalance-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/174698/Ivanti-Avalanche-MDM-Buffer-Overflow.html
- https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US
- http://packetstormsecurity.com/files/174459/Ivanti-Avalance-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/174698/Ivanti-Avalanche-MDM-Buffer-Overflow.html
- https://forums.ivanti.com/s/article/Avalanche-Vulnerabilities-Addressed-in-6-4-1?language=en_US