CVE-2025-1041

published 2025-06-10

CVE-2025-1041: An improper input validation discovered in Avaya Call Management System could allow an unauthorized remote command via a specially crafted web request…

Priority P2 61 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

An improper input validation discovered in

Avaya Call Management System
could allow an unauthorized

remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.

Affected

4 ranges

Vendor	Product	Version range	Fixed in
avaya	avaya_call_management_system	>= 18.0 < 19.2.0.7	19.2.0.7
avaya	avaya_call_management_system	>= 20.0 < 20.0.1.0	20.0.1.0
avaya	call_management_system	>= 18.0.0.1 < 19.2.0.7	19.2.0.7
avaya	call_management_system	>= 20.0 < 20.0.1.0	20.0.1.0

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-20