© 2026 vulntracker.io

CVE-2021-25657

Avaya IP Office Privilege Escalation Vulnerability

HIGH

7.8

CVSS Score

Published: September 2, 2022 at 01:05 AM UTC

Updated: June 17, 2026 at 03:42 AM UTC

1 product affected across 1 vendorIP Office

Using IP Office by Avaya?

Get instant alerts when new vulnerabilities affect IP Office - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.8

Exploit prediction

EPSS 0.3%

Description

A privilege escalation vulnerability was discovered in Avaya IP Office Admin Lite and USB Creator that may potentially allow a local user to escalate privileges. This issue affects Admin Lite and USB Creator 11.1 Feature Pack 2 Service Pack 1 and earlier versions.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

IP Office · Avaya

95%

v ≤ 11.1 Feature Pack 2 Service Pack 1v < 11.111.1 11.1 feature_pack1 11.1 feature_pack1_service_pack1 11.1 feature_pack2 11.1 feature_pack2_service_pack1

Affected range stops below 11.1, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://support.avaya.com/css/P8/documents/101083319

References (2)

x_refsource_MISCExploitThird Party Advisory

Source: [email protected]

https://github.com/mandiant/Vulnerability-Disclosures/blob/master/2022/MNDT-2022-0037/MNDT-2022-0037.md

x_refsource_MISCPatchVendor Advisory

Source: [email protected]

https://support.avaya.com/css/P8/documents/101083319

CVSS

7.8HIGHavaya

Attack Vector: LOCAL
Complexity: LOW
Privileges: LOW
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: HIGH
Integrity: HIGH
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-269NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card