CVE-2024-4196: critical vulnerability in Avaya IP Office
Avaya IP Office Web Control RCE Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
28Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 10epss 0.6%
An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Avaya · IP OfficeRelated CVEs — Avaya IP Office
In the same product, most dangerous first.
CVE-2018-15610HIGHImproper access controls in IP Office one-X PortalEPSS 1.8%CVE-2019-7005MEDIUMUnauthenticated Information Disclosure Vulnerability in IP OfficeEPSS 1.2%CVE-2020-7030MEDIUMIPO Information DisclosureEPSS 1.0%CVE-2024-4197CRITICALAvaya IP Office One-X Portal File Upload VulnerabilityEPSS 0.8%CVE-2018-15614MEDIUMIP Office one-X Portal XSSEPSS 0.6%CVE-2021-25657HIGHAvaya IP Office Privilege Escalation VulnerabilityEPSS 0.3%