PT-2025-24615 · Avaya · Avaya Call Management System

Roberto Olivero · Published 2025-06-10 · Updated 2026-05-26 · CVE-2025-1041

Positive Technologies (AI Summary)

CVSS v3.1

9.9

Critical

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Avaya Call Management System versions 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.

Description An improper input validation in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request.

Recommendations For versions 18.x, consider applying a patch or fix when available. For versions 19.x prior to 19.2.0.7, update to version 19.2.0.7 or later. For versions 20.x prior to 20.0.1.0, update to version 20.0.1.0 or later. As a temporary workaround, consider restricting access to the web request interface to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2025-1041

Affected Products

Avaya Call Management System

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-1041 · Security Note
• https://support.avaya.com/css/public/documents/101093084 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1041 · Vendor Advisory
• https://twitter.com/threatsbank/status/1932392309100089396 · Twitter Post
• https://twitter.com/CVEnew/status/1932329814461161862 · Twitter Post
• https://t.me/cvetracker/25872 · Telegram Post
• https://twitter.com/MNovofastovsky/status/1978551199117816002 · Twitter Post
• https://t.me/cvenotify/125209 · Telegram Post
• https://twitter.com/HugoValters/status/2059129938284806582 · Twitter Post