CVE-2018-15617: Communication Manager Denial of Service

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2019-02-01 · updated 2026-06-17
Weakness: CWE-399

Description

A vulnerability in the "capro" (Call Processor) process component of Avaya Aura Communication Manager could allow a remote, unauthenticated user to cause denial of service. Affected versions include 6.3.x, all 7.x versions prior to 7.1.3.2, and all 8.x versions prior to 8.0.1.

Affected products

Avaya Aura Communication Manager: from 6.3.0.1 through 6.3.17.0; from 7.0 before 7.1.3.2; from 8.0 before 8.0.1 — fixed in 7.1.3.2, 8.0.1

How to fix

Upgrade to a fixed version: Avaya Aura Communication Manager 7.1.3.2, 8.0.1. Check the vendor advisory for mitigations.

References

http://www.securityfocus.com/bid/106826
https://downloads.avaya.com/css/P8/documents/101055396
http://www.securityfocus.com/bid/106826
https://downloads.avaya.com/css/P8/documents/101055396

Get alerted when CVE-2018-15617 or the next vulnerability affects your stack