Avaya IP Office vulnerabilities

9 CVEs affecting Avaya IP Office, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2024-4197, published 2024-06-25.

More from Avaya.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2017-11309, published 2017-11-10. Critical severity, CVSS 9.6. EPSS: 9.4% chance of exploitation in the next 30 days. Buffer overflow in the SoftConsole client in Avaya IP Office before 10.1.1 allows remote servers to execute arbitrary code via a long response.
• CVE-2016-5285, published 2019-11-15. High severity, CVSS 7.5. EPSS: 2.3% chance of exploitation in the next 30 days. A Null pointer dereference vulnerability exists in Mozilla Network Security Services due to a missing NULL check in PK11_SignWithSymKey / ssl3_ComputeRecordMACConstantTime, which could let a remote…
• CVE-2018-15610, published 2018-09-12. High severity, CVSS 8.8. EPSS: 1.8% chance of exploitation in the next 30 days. A vulnerability in the one-X Portal component of Avaya IP Office allows an authenticated attacker to read and delete arbitrary files on the system. Affected versions of Avaya IP Office include 9.1…
• CVE-2019-7005, published 2020-08-07. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. A vulnerability was discovered in the web interface component of IP Office that may potentially allow a remote, unauthenticated user with network access to gain sensitive information. Affected…
• CVE-2020-7030, published 2020-06-04. Medium severity, CVSS 5.5. EPSS: 1% chance of exploitation in the next 30 days. A sensitive information disclosure vulnerability was discovered in the web interface component of IP Office that may potentially allow a local user to gain unauthorized access to the component.…
• CVE-2024-4197, published 2024-06-25. Critical severity, CVSS 9.8. EPSS: 0.8% chance of exploitation in the next 30 days. An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected versions include all versions prior to…
• CVE-2018-15614, published 2019-01-23. Medium severity, CVSS 5.4. EPSS: 0.6% chance of exploitation in the next 30 days. A vulnerability in the one-x Portal component of IP Office could allow an authenticated user to perform stored cross site scripting attacks via fields in the Conference Scheduler Service that could…
• CVE-2024-4196, published 2024-06-25. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component.…
• CVE-2021-25657, published 2022-09-02. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB…