CVE-2024-4196 is a critical (CVSS 10.0) improper input validation flaw in the Web Control component of Avaya IP Office. A specially crafted web request could allow remote command or code execution without a login. All versions before 11.1.3.1 are affected, and Avaya's advisory lists the update to 11.1.3.1 as the resolution.
What's affected
Avaya's advisory, which we retrieved, says the affected versions are IP Office 11.1.3.0 and prior, with the resolution being an update to 11.1.3.1. The NVD record agrees, wording it as all versions prior to 11.1.3.1. We found no conflict between them.
Both sources give a base score of 10.0, Critical, with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That means network reachable, low complexity, no privileges, no user interaction, a changed scope and full impact on confidentiality, integrity and availability.
The advisory is dated 11 June 2024, with the NVD record following on 25 June 2024. The record's KEV flag is false and the advisory we read does not report exploitation.
CVE-2024-4197 is a companion flaw in the One-X component of the same product, fixed in the same release.
How to check if you're exposed
Open the IP Office Manager or the web management page of your system and read the release number. Anything at 11.1.3.0 or below needs the update.
Then check exposure. Find out whether the IP Office web interface is reachable from the internet or from broad internal networks. A quick look at your firewall rules and a review of port forwards to the phone system will answer that. Telephony systems are sometimes published to the internet for remote workers and then forgotten.
If you have a software inventory, search for Avaya IP Office. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related entries.
What to do now
- Identify every Avaya IP Office system and its release number.
- Plan the update to 11.1.3.1 or a later release, following Avaya's upgrade guidance and the service contract rules in the advisory.
- Until the update is done, restrict access to the web management and Web Control components with firewalls and access control lists, as the advisory recommends.
- Remove any internet exposure of the system that is not strictly needed.
- Check device and web logs from before the update for unusual requests, and keep them for later review.
Why it matters
The record classifies the flaw as CWE-782, exposed IOCTL with insufficient access control, though the description talks about improper input validation in a web request. We repeat both because they come from the record. The practical meaning is that the web component accepted input that it should have rejected, and that input could reach functions able to run commands.
The score of 10.0 is rare. It comes from the combination of no login, a network path and a scope change that lets the attacker go beyond the component. Phone systems often sit at the boundary between the voice network and the data network, so a compromise there can be a stepping stone. The advisory's own guidance to use firewalls and access lists matters until you can patch.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
What is the fixed version?
Avaya's advisory says to update to 11.1.3.1. Always check the advisory for any later release that supersedes it.
Sources
- Avaya advisory ASA-2024-000 for IP Office, fetched for this review.
- Safeguard Gold entry for CVE-2024-4196
Last reviewed: 19 October 2026.
