Avaya vulnerabilities
We track 5 vulnerabilities in Avaya products across 6 products. 5 are rated high or critical, and none are known to be exploited. The most recent was published on June 10, 2025.
Latest Avaya vulnerabilities
- 9.8 Critical severity
An improper input validation discovered in Avaya Call Management System could allow an…
An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.
- 9.8 Critical severity
IP Office: Unrestricted Upload of File with Dangerous Type
An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected versions include all versions prior to 11.1.3.1.
- 9.8 Critical severity
IP Office: Exposed IOCTL with Insufficient Access Control
An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.
- 9.8 Critical severity
Aura Device Services: Unrestricted Upload of File with Dangerous Type
An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and ea
- 9.1 Critical severity
Scopia Pathfinder 10 Pts Firmware: Missing Authentication for Critical Functionality
Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification.