Cyber Resilience

CVE-2024-4196

Avaya Ip Office ≤ 11.1.3.1

Published
25 June 2024
Modified
01 October 2025
Patch / advisory
View advisory
CVSS Score v3.1 10.0
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score 0.0059 45th percentile
Risk Priority 75 floored blend · peak EPSS

Summary

CVE-2024-4196 is a critical-severity Exposed IOCTL with Insufficient Access Control (CWE-782) vulnerability in Avaya Ip Office. Its CVSS base score is 10.0 (Critical).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked at the 45th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and AC-6 (Least Privilege) — see the control section below for these in your framework.

EU & UK References

Vulnerability Data

An improper input validation vulnerability was discovered in Avaya IP Office that could allow remote command or code execution via a specially crafted web request to the Web Control component. Affected versions include all versions prior to 11.1.3.1.

CWE(s)
CWE-782NVD-CWE-noinfo

Related Threats

MITRE ATT&CK Enterprise Techniques

T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-4197Same product: Avaya Ip Office
CVE-2025-7771Shared CWE-782
CVE-2024-39251Shared CWE-782
CVE-2025-15641Shared CWE-782
CVE-2026-8797Shared CWE-782
CVE-2024-33219Shared CWE-782
CVE-2024-30804Shared CWE-782
CVE-2026-57851Shared CWE-782
CVE-2025-8061Shared CWE-782
CVE-2024-33221Shared CWE-782

Affected Assets

avaya
ip office
≤ 11.1.3.1

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V8.2.1

Mitigating Controls (NIST 800-53 r5) AI

AC-3 Access Enforcement good match

AC-3 directly requires enforcement of access authorizations on system resources, which structurally stops an IOCTL from being exposed without proper controls.

AC-6 Least Privilege good match

AC-6 requires least-privilege assignments that limit which users or processes can reach privileged IOCTL functionality.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 full match
prevents

Directly enforces least-privilege access permissions on interfaces such as IOCTLs.

PR.IR-01 mostly match
prevents

Protects environments from unauthorized logical access, which includes improperly exposed IOCTL entry points.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect missing IOCTL authorization during development.

A.8.2 Privileged access rights partial match
prevents

Privileged access rights directly restrict who may invoke sensitive IOCTLs.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle includes design-time access-control requirements for device interfaces.

A.8.26 Application security requirements partial match
prevents

Application security requirements capture the need for proper IOCTL authorization.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure system architecture principles mandate least-privilege access to kernel interfaces.

A.8.28 Secure coding partial match
prevents

Secure coding practices prevent omission of access-control checks on IOCTL handlers.

References