CVE-2021-25657

Avaya IP Office Privilege Escalation Vulnerability

Severity Score

7.8

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions.

Se ha detectado una vulnerabilidad de escalada de privilegios en Avaya IP Office Admin Lite y USB Creator que podría permitir a un usuario local escalar privilegios. Este problema afecta a Admin Lite y USB Creator versión 11.1 Feature Pack 2 Service Pack 1 y versiones anteriores

*Credits: N/A

CVSS Scores

NISTv3.1 7.8

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2021-01-21 CVE Reserved
2022-09-02 CVE Published
2023-03-08 EPSS Updated
2024-09-17 CVE Updated
2024-09-17 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-269: Improper Privilege Management

CAPEC

References (2)

URL	Tag	Source

URL	Date	SRC
https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md	2024-09-17

URL	Date	SRC
https://support.avaya.com/css/P8/documents/101083319	2022-09-07

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Avaya Search vendor "Avaya"		Ip Office Search vendor "Avaya" for product "Ip Office"				< 11.1 Search vendor "Avaya" for product "Ip Office" and version " < 11.1"		-		Affected
Avaya Search vendor "Avaya"		Ip Office Search vendor "Avaya" for product "Ip Office"				11.1 Search vendor "Avaya" for product "Ip Office" and version "11.1"		-		Affected
Avaya Search vendor "Avaya"		Ip Office Search vendor "Avaya" for product "Ip Office"				11.1 Search vendor "Avaya" for product "Ip Office" and version "11.1"		feature_pack1		Affected
Avaya Search vendor "Avaya"		Ip Office Search vendor "Avaya" for product "Ip Office"				11.1 Search vendor "Avaya" for product "Ip Office" and version "11.1"		feature_pack1_service_pack1		Affected
Avaya Search vendor "Avaya"		Ip Office Search vendor "Avaya" for product "Ip Office"				11.1 Search vendor "Avaya" for product "Ip Office" and version "11.1"		feature_pack2		Affected
Avaya Search vendor "Avaya"		Ip Office Search vendor "Avaya" for product "Ip Office"				11.1 Search vendor "Avaya" for product "Ip Office" and version "11.1"		feature_pack2_service_pack1		Affected