PT-2025-24615 · Avaya · Avaya Call Management System

Roberto Olivero · Publicado 2025-06-10 · Atualizado 2026-05-26 · CVE-2025-1041

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Crítica

Vetor base

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avaya Call Management System versions 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.

Description An improper input validation in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request.

Recommendations For versions 18.x, consider applying a patch or fix when available. For versions 19.x prior to 19.2.0.7, update to version 19.2.0.7 or later. For versions 20.x prior to 20.0.1.0, update to version 20.0.1.0 or later. As a temporary workaround, consider restricting access to the web request interface to minimize the risk of exploitation.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2025-1041

Produtos afetados

Avaya Call Management System

Referências · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-1041 · Nota de Segurança
• https://twitter.com/threatsbank/status/1932392309100089396 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1932329814461161862 · Publicação no Twitter
• https://t.me/cvetracker/25872 · Publicação no Telegram
• https://support.avaya.com/css/public/documents/101093084 · Aviso do Fabricante
• https://twitter.com/MNovofastovsky/status/1978551199117816002 · Publicação no Twitter
• https://osv.dev/vulnerability/CVE-2025-1041 · Aviso do Fabricante
• https://t.me/cvenotify/125209 · Publicação no Telegram
• https://twitter.com/HugoValters/status/2059129938284806582 · Publicação no Twitter