Skip to content
OpenAdvisories
Critical · 9.9 CVE-2025-1041 EUVD-2025-17628GHSA-mm4v-5mwg-c6qp

Avaya Call Management System RCE vulnerability

Published Jun 10, 2025 · Updated Jun 10, 2025 · Assigned by avaya

Description

An improper input validation discovered in

Avaya Call Management System
could allow an unauthorized

remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.

Affected products

VendorProductAffectedFixed
Avaya Avaya Call Management System 18.0 – < 19.2.0.7, 20.0 – < 20.0.1.0 19.2.0.7

References