Vulnerability record · CVE-2021-42125 · published 7 December 2021
CVE-2021-42125: Ivanti Avalanche Inforail Service unrestricted file upload
Ivanti · Avalanche
Ivanti Avalanche before 6.3.3 contains an unrestricted file upload flaw in the Inforail Service, allowing an attacker with access to that service to write dangerous files. The record also maps the issue to untrusted data deserialization (CWE-502), so the exact write path is not fully detailed in the supplied description. Because the service is network-reachable and the flaw can lead to code or file placement, it is a serious risk for exposed deployments.
Description
An unrestricted file upload vulnerability exists in Ivanti Avalanche before 6.3.3 allows an attacker with access to the Inforail Service to write dangerous files.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Automated analysis
high priorityNetwork-reachable file upload with high CVSS impact and very high EPSS, though no KEV listing or confirmed public exploit is recorded.
What it is
Ivanti Avalanche before 6.3.3 contains an unrestricted file upload flaw in the Inforail Service, allowing an attacker with access to that service to write dangerous files. The record also maps the issue to untrusted data deserialization (CWE-502), so the exact write path is not fully detailed in the supplied description. Because the service is network-reachable and the flaw can lead to code or file placement, it is a serious risk for exposed deployments.
Impact
An attacker who can reach the Inforail Service can upload and place dangerous files, potentially leading to remote code execution or full compromise of the Avalanche server. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network via the Inforail Service (AV:N); the vector requires low privileges (PR:L) and no user interaction (UI:N). Access to the Inforail Service is the prerequisite, so the service should not be exposed to untrusted networks.
Exploitation
Not listed in CISA KEV and no public exploit tag appears in the references, but EPSS is very high at 0.816 (99.6th percentile), indicating elevated likelihood of attempted exploitation. Only vendor advisory references are provided.
What to do
- Upgrade Ivanti Avalanche to 6.3.3 or later per the vendor advisory.
- Restrict network access to the Inforail Service to trusted hosts and block it from the internet.
- Enforce least privilege and strong authentication for accounts that can reach the service.
- Monitor and restrict file write locations used by the service, and validate uploaded file types where configuration allows.
- If patching is delayed, isolate affected Avalanche servers on segmented networks.
Detection
- Monitor the Inforail Service for unexpected file write or upload activity, especially new executable or script files.
- Alert on file creation in web-accessible or service directories outside normal deployment windows.
- Review service logs for anomalous upload requests or deserialization errors tied to Inforail.
- Baseline normal file activity on Avalanche hosts and alert on deviations.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2021-42125 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-42125), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
