Vulnerability · Published Jun 25, 2021 · Assigned by avaya
CVE-2021-25654Avaya Aura Device Services Arbitrary Code Execution Vulnerability
Medium 6.2
In plain English
A medium-severity security flaw in Avaya Aura Devices Services from Avaya. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities).
Severity (CVSS 3.1)6.2Medium
Exploit odds (30 days)0.8%top 44.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Avaya | Avaya Aura Devices Services | 7.0.0 – through 8.1.4.0 |
Weakness: CWE-378 · Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
References
- https://support.avaya.com/css/P8/documents/101076523 x_refsource_MISC