Ivanti Avalanche Under Attack: Off-by-one Error Leads to DoS

CVE-2024-36136

What is CVE-2024-36136?

The vulnerability identified in Ivanti Avalanche 6.3.1 is an off-by-one error in the WLInfoRailService component. This flaw can be exploited by a remote unauthenticated attacker, leading to a potential denial-of-service attack. When successfully exploited, it allows attackers to crash the service, disrupting operations and impacting availability. Organizations using this version of Ivanti Avalanche should take immediate action to address this vulnerability to safeguard their systems against possible malicious exploits.

References