Read the docs
TI-2024-06932 Aliases CVE-2024-7480GHSA-2hrx-xx6v-c3v2

Improper access control in Avaya Aura System Manager

Priority LOW 19CWE-266Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Privilege escalation
Confidentiality · integrity · availability
High · None · None
Fix status
No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-266.

Summary

An Improper access control vulnerability was found in Avaya Aura System Manager which could allow a command-line interface (CLI) user with administrative privileges to read arbitrary files on the system. Affected versions include 10.1.x.x and 10.2.x.x. Versions prior to 10.1 are end of manufacturer support.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00151 4th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
AvayaAura System Manager10.1.x.x; 10.2.x.x—No fix listedCNA
  • Aura System Manager VendorAvaya Affected 10.1.x.x; 10.2.x.x Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:avaya:aura_system_manager:*:*:*:*:*:*:*:*10.1 – 10.1.2VulnerableAvaya
cpe:2.3:a:avaya:aura_system_manager:10.2:*:*:*:*:*:*:*10.2VulnerableAvaya
  • cpe:2.3:a:avaya:aura_system_manager:*:*:*:*:*:*:*:* Versions 10.1 – 10.1.2 Vulnerable ·Avaya
  • cpe:2.3:a:avaya:aura_system_manager:10.2:*:*:*:*:*:*:* Versions 10.2 Vulnerable ·Avaya

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-7480
  2. 2026-10-03 Alias added: GHSA-2hrx-xx6v-c3v2

References

Advisory 1

  • TI-2010-02816 The xfs implementation in the Linux kernel before 2.6.35 does not look up inode… CVSS 3.1HIGH 8.1
  • TI-2016-04582 NULL pointer dereference in Mozilla Network Security Services CVSS 3.1HIGH 7.5
  • TI-2020-05672 Avaya WebLM Improper Restriction of XML External Entity Reference CVSS 3.1MEDIUM 6.5
  • TI-2010-02675 The gfs2_dirent_find_space function in fs/gfs2/dir.c in the Linux kernel before 2.6.35… CVSS 3.1HIGH 7.8
  • TI-2010-02392 Buffer overflow in the ecryptfs_uid_hash macro in fs/ecryptfs/messaging.c in the eCryptfs… CVSS 3.1HIGH 7.8
  • TI-2009-03736 The poll_mode_io file for the megaraid_sas driver in the Linux kernel 2.6.31.6 and… CVSS 3.1HIGH 7.1
See all 8 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences