PT-2021-3463 · Avaya · Avaya Aura Device Services

Gerardo Iglesias + 1 · Published 2021-06-25 · Updated 2022-08-01 · CVE-2021-25654

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avaya Aura Device Services versions 7.0 through 8.1.4.0

Description An arbitrary code execution issue was discovered in Avaya Aura Device Services, potentially allowing a local user to execute specially crafted scripts. The vulnerability is related to the creation of temporary files with insecure permissions.

Recommendations For versions 7.0 through 8.1.4.0, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-378

Related Identifiers

BDU:2021-03327

CVE-2021-25654

Affected Products

Avaya Aura Device Services

References · 7

• https://osv.dev/vulnerability/CVE-2021-25654 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03327 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-25654 · Security Note
• https://support.avaya.com/css/P8/documents/101076523 · Vendor Advisory
• https://downloads.avaya.com/css/P8/documents/101076523 · Note
• https://t.me/cvenotify/16748 · Telegram Post
• https://t.me/cibsecurity/25725 · Telegram Post