CVE-2023-3722

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
AvayaAura Device Services< 8.1.4.1
avayaaura_device_services< 8.1.4.1

References

Timeline

Published
Jul 19, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-372209.8Synel Terminals - CWE-494: Download of Code Without Integrity CheckCVE-2023-372216.17Twenty BOT - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting').CVE-2023-372224.8Farsight Tech Nordic AB ProVide version 14.5 - Multiple XSS vulnerabilities (CWE-79) can be exploited by a user with administrator privilegeCVE-2023-372235.4Cross Site Scripting (XSS) vulnerability in Archer Platform before v.6.13 and fixed in v.6.12.0.6 and v.6.13.0 allows a remote authenticatedCVE-2023-372245.5An issue in Archer Platform before v.6.13 fixed in v.6.12.0.6 and v.6.13.0 allows an authenticated attacker to obtain sensitive information CVE-2023-372256.1Pexip Infinity before 32 allows Webapp1 XSS via preconfigured links.CVE-2023-372269.8Loftware Spectrum before 4.6 HF14 has Missing Authentication for a Critical Function.CVE-2023-372279.8Loftware Spectrum before 4.6 HF13 Deserializes Untrusted Data.CVE-2023-372298.8Loftware Spectrum before 5.1 allows SSRF.CVE-2023-372308.8Loftware Spectrum (testDeviceConnection) before 5.1 allows SSRF.CVE-2023-372319.8Loftware Spectrum before 4.6 HF14 uses a Hard-coded Password.CVE-2023-372327.5Loftware Spectrum through 4.6 exposes Sensitive Information (Logs) to an Unauthorized Actor.
CVE-2023-3722: Critical severity, CVSS 9.8 | Vulnix