CVE-2024-4196

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-782

Affected software

No affected versions have been published.

Timeline

Published: Jun 25, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-419604.8mailcow: dockerized is an open source groupware/email suite based on docker. An authenticated admin user can inject a JavaScript payload int CVE-2024-419619.6Elektra is an opinionated Openstack Dashboard for Operators and Consumers of Openstack Services. A code injection vulnerability was found in CVE-2024-419626.3Bostr is an nostr relay aggregator proxy that acts like a regular nostr relay. bostr let everyone in even having authorized_keys being set w CVE-2024-419648.1Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only CVE-2024-419654.2Vim is an open source command line text editor. double-free in dialog_changed() in Vim < v9.1.0648. When abandoning a buffer, Vim may ask th CVE-2024-419678.1A low privileged remote attacker may modify the boot mode configuration setup of the device, leading to modification of the firmware upgrade CVE-2024-419685.4A low privileged remote attacker may modify the docker settings setup of the device, leading to a limited DoS.CVE-2024-419698.8A low privileged remote attacker may modify the configuration of the CODESYS V3 service through a missing authentication vulnerability which CVE-2024-41979.8An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X CVE-2024-419705.7A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.CVE-2024-419718.1A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.CVE-2024-419726.5A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privil