Avaya Call Management System vulnerabilities

3 CVEs affecting Avaya Call Management System, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2025-1041, published 2025-06-10.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2016-5285, published 2019-11-15. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote…
CVE-2023-3527, published 2023-07-18. Medium severity, CVSS 6.8. EPSS: 0.6% chance of exploitation in the next 30 days. A CSV injection vulnerability was found in the Avaya Call Management System (CMS) Supervisor web application which allows a user with administrative privileges to input crafted data which, when…
CVE-2025-1041, published 2025-06-10. Critical severity, CVSS 9.8. EPSS: 0.4% chance of exploitation in the next 30 days. An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior…