CVE-2024-50320

CVE-2024-50320 is an infinite loop (CWE-835) in Ivanti Avalanche, the vendor's enterprise mobile device management platform, affecting all versions before 6.4.6. A remote, unauthenticated attacker can trigger the loop by sending network requests to the Avalanche service, causing it to hang. The result is a denial of service: the affected service stops responding until it is restarted, with no confidentiality or integrity impact per the CVSS scoring (C:N/I:N/A:H). Any organization running an unpatched Ivanti Avalanche deployment is exposed, though deployments of this on-premises enterprise MDM are typically internal-facing. As of now there is no known public proof-of-concept, the flaw is not in CISA's KEV, and no confirmed in-the-wild exploitation has been reported, but EPSS puts its probability of exploitation within 30 days at about 40% (99th percentile).

What to do: Upgrade Ivanti Avalanche to version 6.4.6 or later. Where patching is not immediately possible, restrict network access to the Avalanche server so untrusted clients cannot reach it, and monitor Ivanti's advisory for updates. Given the elevated EPSS score, prioritize this fix even though no active exploitation has been confirmed.