CVE-2024-24996

—

CVSS 3.1

9.8 critical

EPSS

32%p98

Published

Apr 19, 2024 (Apr 19, 2024)

Modified

Jun 17, 2026

Description

A Heap overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows an unauthenticated remote attacker to execute arbitrary commands.

Vendors: ivanti
Products: avalanche
Weakness: CWE-122
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (32.2%)

In the news4 stories

Week in review: Palo Alto firewalls mitigation ineffective, PuTTY client vulnerable to key recovery attack

Help Net SecurityApr 21, 00:00 UTC · Apr 21, 2024Ransomware CVE-2024-3400 CVE-2024-31497 CVE-2024-29204+1 CVEs

Ivanti patches critical Avalanche flaw exploitable via a simple message (CVE-2024-29204)

Help Net SecurityApr 18, 00:00 UTC · Apr 18, 2024Vulnerability CVE-2024-29204 CVE-2024-24996

Ivanti fixed two critical flaws in its Avalanche MDM

Security AffairsApr 17, 10:49 UTC · Apr 17, 2024Vulnerability CVE-2024-24996 CVE-2024-29204

Ivanti Patches Two Critical Avalanche Flaws in Major Update

Infosecurity MagazineApr 17, 10:15 UTC · Apr 17, 2024Vulnerability in the wildCVE-2024-24996 CVE-2024-29204