CVE-2023-28126
Quick assessment
Affected
n/a Avalanche
Exploitation
High exploitation probability; assess promptly
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Ivanti Avalanche是美国Ivanti公司的一套企业移动设备管理系统。该系统主要用于管理智能手机、平板电脑和条形码扫描仪等设备。 Ivanti Avalanche 6.3.x版本及之前版本存在安全漏洞。攻击者利用该漏洞通过SetUser方法获得访问权限。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2023-28126
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
An authentication bypass vulnerability exists in Avalanche versions 6.3.x and below that could allow an attacker to gain access by exploiting the SetUser method or can exploit the Race Condition in the authentication message.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
使用基本弱点进行的认证绕过
Source: CVE Program / CVE List V5
Vulnerability Title
Ivanti Avalanche 竞争条件问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Ivanti Avalanche是美国Ivanti公司的一套企业移动设备管理系统。该系统主要用于管理智能手机、平板电脑和条形码扫描仪等设备。 Ivanti Avalanche 6.3.x版本及之前版本存在安全漏洞。攻击者利用该漏洞通过SetUser方法获得访问权限。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| - | Avalanche | Avalanche versions 6.3.x and below | - |
|
II. Public POCs for CVE-2023-28126
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2023-28126
请登录查看更多情报信息。
Other References for CVE-2023-28126 (1)
Same Patch Batch · n/a · 2023-05-09 · 48 CVEs total
| CVE-2023-29092 | 3.1 LOW | wfc-pkt-router 安全漏洞 |
| CVE-2020-23362 | shopcms_lang 安全漏洞 | |
| CVE-2023-31478 | GL.iNet 安全漏洞 | |
| CVE-2023-28317 | Rocket.Chat 授权问题漏洞 | |
| CVE-2023-28316 | Rocket.Chat 授权问题漏洞 | |
| CVE-2023-28128 | Ivanti Avalanche 代码问题漏洞 | |
| CVE-2023-28127 | Ivanti Avalanche 路径遍历漏洞 | |
| CVE-2023-28125 | Ivanti Avalanche 竞争条件问题漏洞 | |
| CVE-2023-28318 | Rocket.Chat 授权问题漏洞 | |
| CVE-2023-31474 | GL.iNet 安全漏洞 | |
| CVE-2020-18280 | Phodal CMD 安全漏洞 | |
| CVE-2023-31472 | GL.iNet 安全漏洞 | |
| CVE-2020-23363 | Verydows 安全漏洞 | |
| CVE-2021-31240 | libming 安全漏洞 | |
| CVE-2021-31711 | ResponsiveFilemanager 跨站脚本漏洞 | |
| CVE-2023-30083 | Libming 安全漏洞 | |
| CVE-2023-30084 | libming 安全漏洞 | |
| CVE-2023-30085 | libming 安全漏洞 | |
| CVE-2023-30086 | LibTIFF 缓冲区错误漏洞 | |
| CVE-2023-30087 | Cesanta MJS 缓冲区错误漏洞 |
Showing top 20 of 48 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same weakness: CWE-305
-
CVE-2026-77185
Apache MINA SSHD: Asynchronous authentication can bypass sig -
CVE-2026-59563
HMAC Confirmation Token Unbinding in zscaler-mcp-server -
CVE-2026-88837
Busybox: busybox: httpd misidentifies yescrypt password hash -
CVE-2026-85500
`require_confirmed_with` is not enforced on the action and f -
CVE-2026-86207
Authentication bypass leads to unauthorised access to N-cent
V. Comments for CVE-2023-28126
No comments yet