CVE-2024-4197

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

An unrestricted file upload vulnerability in Avaya IP Office was discovered that could allow remote command or code execution via the One-X component. Affected versions include all versions prior to 11.1.3.1.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-434

Affected software

VendorProductVersions
AvayaIP Office< 11.1.3.1
avayaip_office< 11.1.3.1

References

Timeline

Published
Jun 25, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-419705.7A low privileged remote attacker may gain access to forbidden diagnostic data due to incorrect permission assignment for critical resources.CVE-2024-419718.1A low privileged remote attacker can overwrite an arbitrary file on the filesystem leading to a DoS and data loss.CVE-2024-419726.5A low privileged remote attacker can overwrite an arbitrary file on the filesystem which may lead to an arbitrary file read with root privilCVE-2024-419738.1A low privileged remote attacker can specify an arbitrary file on the filesystem which may lead to an arbitrary file writes with root privilCVE-2024-419747.1A low privileged remote attacker may modify the BACNet service properties due to incorrect permission assignment for critical resources whicCVE-2024-419755.3An unauthenticated remote attacker can gain limited information of the PLC network but the user management of the PLCs prevents the actual aCVE-2024-419768.8A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2024-419778.0A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2024-419786.5A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.1), RUGGEDCOM RM1224 LTE(4G) NAM CVE-2024-419798.0A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=CVE-2024-41982.7Mattermost versions 9.6.0, 9.5.x before 9.5.3, and 8.1.x before 8.1.12 fail to fully validate role changes which allows an attacker authentiCVE-2024-419805.7A vulnerability has been identified in SmartClient modules Opcenter QL Home (SC) (All versions >= V13.2 < V2506), SOA Audit (All versions >=
CVE-2024-4197: Critical severity, CVSS 9.8 | Vulnix