A vulnerability has been reported in various Avaya products, which can be exploited by malicious users to compromise a vulnerable system.

The vulnerability is caused due to an unspecified input validation error. This can be exploited to inject and execute arbitrary shell commands via web page input fields.

A weakness has also been reported, where port 8009 is unnecessarily open.

The following products are affected:
* Avaya S87XX/S8500/S8300 (all versions prior to CM 3.1.3)
* Avaya SES (all versions)

Solution
Avaya S87XX/S8500/S8300:
Further details available in Customer Area

Provided and/or discovered by
Reported by the vendor.

Changelog
Further details available in Customer Area

Original Advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-051.htm
http://support.avaya.com/elmodocs2/security/ASA-2007-052.htm

Deep Links
Links available in Customer Area