Back to overview

CVE-2025-1041

CRITICAL
9.9
CVSS 3.1
Description
An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.

Metadata

CVE ID
CVE-2025-1041
State
PUBLISHED
Assigner
avaya
Reserved
2025-02-04 20:04 UTC
Published
2025-06-10 06:05 UTC
Last updated
2025-06-10 20:00 UTC
Primary CWE
CWE-20
CWE-20 Improper Input Validation
Vendor / Product
Avaya / Avaya Call Management System
Sources
cve.org  ·  NVD

Severity & Metrics

9.9 CRITICAL CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SSVC — CISA Coordinator
Exploitation
none
Automatable
no
Tech. Impact
total
Affected products (1)
VendorProductPlatformVersions
Avaya Avaya Call Management System — 18.0 < 19.2.0.7, 20.0 < 20.0.1.0
Weakness (CWE)
CWESourceDescription
CWE-20 cna CWE-20 Improper Input Validation
CVSS scores (1)
ScoreSeverityVersionSourceVector
9.9 CRITICAL 3.1 cna CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
References (1)
Back to overview