The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →In August 2023, Ivanti released Avalanche version 6.4.1.207 to fix seven critical- and high-severity vulnerabilities. The most severe, CVE-2023-32563, was a CVSS 9.8 directory-traversal flaw that could allow an unauthenticated attacker to execute code remotely. This is a report on that historical patch—not confirmation that 6.4.1.207 is sufficient today.
What did Ivanti patch in August 2023?
SecurityWeek reported on August 16, 2023, that Avalanche 6.4.1.207, released earlier that month, addressed seven critical- and high-severity vulnerabilities in Ivanti’s enterprise mobile device management (MDM) solution. The flaws included remote code execution, buffer overflows, and authentication bypasses. SecurityWeek’s report identifies the fixed version and summarizes the vulnerabilities.
The seven vulnerabilities
| CVE | Issue reported | Severity information reported |
|---|---|---|
| CVE-2023-32563 | Directory traversal in the updateSkin method, enabling unauthenticated remote code execution |
CVSS 9.8; most severe of the seven |
| CVE-2023-32560 | Multiple stack-based buffer overflow bugs | CVSS 8.8 |
| CVE-2023-32562 | Remote code execution vulnerability | High severity; score not stated in SecurityWeek’s report |
| CVE-2023-32564 | Remote code execution vulnerability | High severity; score not stated in SecurityWeek’s report |
| CVE-2023-32561 | Authentication-bypass flaw | High severity; score not stated in SecurityWeek’s report |
| CVE-2023-32565 | Authentication-bypass flaw | High severity; score not stated in SecurityWeek’s report |
| CVE-2023-32566 | Authentication-bypass flaw | High severity; score not stated in SecurityWeek’s report |
Why was CVE-2023-32563 considered critical?
The flaw was in Avalanche’s updateSkin method. As SecurityWeek relayed from the Zero Day Initiative advisory, “The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of System.” The risk followed from accepting an inadequately validated path and using it in file operations: a remote attacker did not need to authenticate before exploiting the issue to run code with System context.
Which Avalanche version fixed the 2023 vulnerabilities?
For the seven vulnerabilities in the August 2023 report, the identified fix was Avalanche 6.4.1.207. That version number applies to this specific 2023 disclosure; it should not be treated as the latest or currently adequate Avalanche release.
Recommended Free Tools
#1 Best Overall
- [ Latest Android 15 OS with GMS Certified ] – Powered by the upgraded Android 15 OS and MT6765 octa-core (up to 2.3 GHz) processor, Arrvel F2 industrial pda delivers lag-free multitasking for inventory workers. The generous 4GB RAM + 64GB ROM effortlessly runs WMS, ERP, and mainstream inventory apps (Odoo, Zoho Inventory, Orca Scan, inFlow, Sortly). Supporting 4G LTE connectivity, it delivers reliable mobile data sync for retail, logistics, warehouse and asset management
- [ Advanced Enterprise-Class Scanning ] – Powered by Zebra SE4710 scan engine, the F2 inventory scanner enables fast, first-time accurate capture of virtually all 1D/2D/QR barcodes—even damaged, dirty, reflective or poorly printed codes. Supporting a scanning range up to 26 inches (66 cm), it eliminates ladder use for safer warehouse operations and streamlines daily workflow for retail, logistics and inventory management teams
- [5050mAh Battery & Seamless Connectivity ] – Built for 24/7 uninterrupted performance. Features a 5050mAh removable battery for quick swaps during extended shifts, providing up to 12 hours of continuous use. Stay connected and sync WMS data in real-time with 4G LTE, WiFi, Bluetooth and NFC. Whether in a shipping yard, port, or field operation, your team has instant access to your data center
- [ IP67 Rugged & Cold-Chain Ready ] – Engineered for punishing industrial environments, handheld PDA is fully dust-tight and survives 1-meter water submersion for 30 minutes. Its reinforced chassis withstands repeated 4.92ft (1.5m) drops to concrete, significantly reducing downtime from accidental falls. It operates reliably from -4°F to 122°F (-20°C to 50°C). Perfect for cold chain warehouses, freezers, refrigerated deliveries, and heavy industrial operations
- [ 6 Inch FHD+ Sunlight-Readable Display ] - Elevate your workflow with the stunning 6-inch 1080x2160 FHD high-resolution screen, delivering sharp visuals and a broader field of view for complex inventory spreadsheets and GIS mapping. Boasting an industry-leading 500 nits brightness, this pro-grade display remains crystal clear even under intense midday sun, effectively eliminating outdoor glare. Whether you're managing yard logistics or field inspections, the high-pixel density ensures every detail is legible, reducing eye strain
Was the 2023 flaw reported as exploited in the wild?
SecurityWeek’s August 16, 2023 report said there was no mention of any of the seven issues being exploited in the wild at that time. This is a contemporaneous statement about what the report disclosed, not proof that exploitation never occurred and not a current threat assessment.
How did later Avalanche vulnerability disclosures differ?
Ivanti disclosed additional Avalanche vulnerabilities in later, separate patch cycles. The CVEs and version ranges below belong to those later disclosures; they are not part of the seven vulnerabilities reported in 2023.
Rank #2
- Larger battery enables longer continuous usage and twice the stand-by time. With the unique battery indicator light showing the remaining battery level, no more Low Battery Anxiety.
- The curved handle is extended and widened. With specially designed smooth and flat trigger for a better grip.
- The orange anti shock silicone protective cover can prevent scratches and friction even when dropped from up to 6.56 feet. IP54 technology protects the wireless barcode scanner from dust.
- Plug and play with the USB receiver or the USB cable, no driver installation needed. Easy and quick to set up. Wireless transmission distance reaches up to 328 ft. in barrier free environment.
- Supports almost all 1D Barcodes: Febraban Bank Code, Codabar, Code 11, Code93, MSI, Code 128, EAN-128, Code 39, EAN-8, EAN-13, UPC-A, ISBN, Industrial 25, Interleaved 25, Standard 25, Matrix. Reads damaged, fuzzy, reflective and smudged barcodes.
April 2024: 27 vulnerabilities affecting versions before 6.4.3
On April 17, 2024, CERT-EU reported that Avalanche versions before 6.4.3 were affected by 27 vulnerabilities. Two—CVE-2024-24996 and CVE-2024-29204—were CVSS 9.8 heap-based buffer overflows in WLInfoRailService and WLAvalancheService. CERT-EU said unauthenticated remote attackers could exploit them in low-complexity attacks without user interaction to execute arbitrary commands. The other 25 flaws ranged from medium to high severity and could enable denial of service, command execution as SYSTEM, or sensitive-information disclosure. CERT-EU recommended updating to the fixed version as soon as possible. See the CERT-EU advisory for its details.
October 2024 and August 2025: further vendor updates
Ivanti’s October 8, 2024 security update confirmed that Avalanche fixes had been released and linked to the product advisory. Its statement that it had no evidence of exploitation applied to the other vulnerabilities discussed in that update and excluded a separately described CSA exploitation case. Ivanti’s October 2024 update provides that context.
Rank #3
- Superior scanning performance on any 1D and 2D barcode, in any condition------The advanced imager reads 1D barcodes displayed on a screen or printed on a label faster and farther than other standard scanners. Easily read barcodes even if they are under shrinkwrap, damaged, dirty or poorly printed.
On August 12, 2025, Ivanti again listed Avalanche among the products for which it was disclosing vulnerabilities. The company said it had no evidence that the vulnerabilities announced in that update were being exploited in the wild. That statement concerns the 2025 disclosure, not all Avalanche flaws or present-day threat activity. See Ivanti’s August 2025 update.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What should Avalanche administrators do now?
The historical reporting establishes which version fixed the 2023 set, but it does not establish the newest Avalanche advisory or a supported, fixed release as of October 4, 2026. Administrators making a current update decision should consult Ivanti’s live Avalanche security advisory, confirm the affected and fixed versions for their deployment, and follow the vendor’s current remediation instructions. Do not rely on 6.4.1.207 as present-day remediation guidance solely because it fixed the 2023 vulnerabilities.
Quick Recap
Best Value
- Superior scanning performance on any 1D barcode, in any condition------The advanced imager reads 1D barcodes displayed on a screen or printed on a label faster and farther than other standard scanners. Easily read barcodes even if they are under shrinkwrap, damaged, dirty or poorly printed.
- Ultra-rugged, the most indestructible design in its class------The LI3678 is the most rugged scanner yet, with the highest drop, tumble and sealing specification in its class. The LI3678 is built to survive an 8 ft./2.4 m drop to concrete, 23 percent more durable than any other scanner in this class. It is dustproof, sprayproof and waterproofed to IP67, it can be sprayed down with jetting water and even submersed in water for up to 30 minutes.
- Extreme temperature rating------Built to handle extreme cold, heat and more, you can use the LI3678 anywhere, even in the freezer.
- A Bluetooth model in a class of its own provides lightning fast wireless communication and maximum energy efficiency.------Zebra Wi-Fi Friendly Mode eliminates the wireless interference that Bluetooth devices can often create in your Wi-Fi environment. The ‘go anywhere’ rugged cradle offers superior versatility and durability. The LI3678 cradle is the only one in its class to offer IP65 sealing. And its industrial charging contacts withstand 250,000 insertions.
- Three flexible feedback modes------Mix and match the feedback modes that are ideal in your environment — vibration, red and green LEDs located in an area where they are always easy to see, plus the traditional loud beep tone.
Rank #4
- 【Unique Designed Screen Setting】It allows you to customize the screen display according to your preferences. With this innovative feature, you can easily set the language, adjust volume settings, select connection options, and view stored and total barcodes. Experience unparalleled convenience and flexibility as you personalize the settings of your Tera HW0009 to suit your specific needs. 【Package Includes: Barcode Scanner x1, Charging Cradle x1, Charging Cable x1, User Manual x1】
- 【Superior Global CMOS Imaging Scanning】This advanced scanner excels in fast and accurate reading of both ordinary and high-density barcodes, including challenging formats like PDF417 found on driver's licenses. Its exceptional performance effortlessly handles various scanning scenarios, including underwater scanning, reading barcodes on silver paper, reflective materials, and more.
- 【Charging Cradle & 2500mAh Large Battery】Designed with a convenient charging cradle, the HW0009 barcode scanner allows you to easily charge it whenever it's not in use. In addition, the scanner itself is equipped with a powerful 2500mAh battery, ensuring seamless all-day operation without the need for frequent charging.
- 【3-in-1 Connections & Widely Compatible】 Tera HW0009 wireless barcode scanner can work with bluetooth & 2.4G wireless & usb wired. The transmission distance can be 328ft in barrier free environment and 114ft in obstacles environment using 2.4G USB dongle. It can be connected with a variety of devices, such as smartphones, computers, POS, tablets. In addition, it is also compatible with various operating systems, such as windows 11/10/8/7/xp, Mac OS, iOS, android, linux.
- 【1D 2D QR code Programmable】2D: QR code, Data Matrix, PDF417(including PDF417 on driver’s license), Aztec, Maxicode, Micro QR, Micro PDF417; 1D: UPC/EAN, Code 128/EAN128, GS1-128, ISBT-128, Standard 2 of 5, Matrix 2 of 5, Code 39, Code 32, Code 93, Code 11, Codabar, PLESSEY, MSI, GSI Databar, ITF-14, GS1.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
