Vulnerability · Published Apr 23, 2021 · Assigned by avaya
CVE-2020-7034Command injection in Avaya Session Border Controller for Enterprise
High 7.2
In plain English
A high-severity OS command injection in Session Border Controller for Enterprise from Avaya. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.4% (higher than 84% of all known vulnerabilities).
Severity (CVSS 3.1)7.2High
Exploit odds (30 days)2.4%top 16.1% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
A command injection vulnerability in Avaya Session Border Controller for Enterprise could allow an authenticated, remote attacker to send specially crafted messages and execute arbitrary commands with the affected system privileges. Affected versions of Avaya Session Border Controller for Enterprise include 7.x, 8.0 through 8.1.1.x
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Avaya | Session Border Controller for Enterprise | 7.x8.0 – through 8.1.1.x |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://downloads.avaya.com/css/P8/documents/101075451 x_refsource_CONFIRM