A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions.
Weakness
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Ip_office | Avaya | * | 11.1 (excluding) |
| Ip_office | Avaya | 11.1 (including) | 11.1 (including) |
| Ip_office | Avaya | 11.1-feature_pack1 (including) | 11.1-feature_pack1 (including) |
| Ip_office | Avaya | 11.1-feature_pack1_service_pack1 (including) | 11.1-feature_pack1_service_pack1 (including) |
| Ip_office | Avaya | 11.1-feature_pack2 (including) | 11.1-feature_pack2 (including) |
| Ip_office | Avaya | 11.1-feature_pack2_service_pack1 (including) | 11.1-feature_pack2_service_pack1 (including) |
Potential Mitigations
Related Attack Patterns
- https://cwe.mitre.org/data/definitions/122.html
- https://cwe.mitre.org/data/definitions/233.html
- https://cwe.mitre.org/data/definitions/58.html
References
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md
- https://support.avaya.com/css/P8/documents/101083319
- https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md
- https://support.avaya.com/css/P8/documents/101083319