An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.
Details
| Severity | Base Score | CVE |
|---|---|---|
| CRITICAL | 9.9 | CVE-2025-1041 |
Exploitation
To exploit this vulnerability, an attacker can send a specially crafted web request to the Avaya Call Management System, which may allow them to execute unauthorized commands remotely. The low attack complexity and lack of required user interaction make this vulnerability particularly dangerous.
Affected Products
- Avaya Call Management System 18.x: Older versions are vulnerable to remote command execution.
- Avaya Call Management System 19.x: Versions prior to 19.2.0.7 are affected.
- Avaya Call Management System 20.x: Versions prior to 20.0.1.0 are at risk.
Mitigation
To mitigate this vulnerability, users should upgrade their Avaya Call Management System to the latest versions that address this issue. Regularly applying security patches and updates is essential to protect against such vulnerabilities.