CVE-2025-1041 Avaya Call Management System RCE vulnerability
An attacker can execute arbitrary remote commands via a crafted web request in Avaya Call Management System.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2025-1041?
CVE-2025-1041 is a critical command injection vulnerability in Avaya Call Management System, published on 10 Jun 2025. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An improper input validation discovered in
Avaya Call Management System could allow an unauthorized
remote command via a specially crafted web request. Affected versions include 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.
Weakness: CWE-20
Which versions are affected by CVE-2025-1041?
It affects 1 product.
Products include Avaya Call Management System.
How do I fix CVE-2025-1041?
No fix has been published for CVE-2025-1041 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2025-1041 being exploited?
There is no known exploitation of CVE-2025-1041 in the wild and no public exploit code.
Other vulnerabilities in Avaya Call Management System
Sources
Also known as GHSA-mm4v-5mwg-c6qp.