What’s Vulnerable › Vulnerabilities

CVE-2021-25657: Avaya IP Office Privilege Escalation Vulnerability

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2022-09-02 · updated 2026-06-17
• Weakness: CWE-269

Description

A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions.

Affected products

• Avaya IP Office: before 11.1; 11.1, 11.1-feature_pack1, 11.1-feature_pack1_service_pack1, 11.1-feature_pack2, 11.1-feature_pack2_service_pack1 — fixed in 11.1

How to fix

Upgrade to a fixed version: Avaya IP Office 11.1. Check the vendor advisory for mitigations.

References

• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md
• https://support.avaya.com/css/P8/documents/101083319
• https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md
• https://support.avaya.com/css/P8/documents/101083319

Get alerted when CVE-2021-25657 or the next vulnerability affects your stack