A Heap Overflow vulnerability in WLInfoRailService component of Ivanti Avalanche before 6.4.3 allows a remote unauthenticated attacker to execute arbitrary commands 
CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')