CVE-2024-4197 is a critical (CVSS 9.9) unrestricted file upload flaw in the One-X component of Avaya IP Office. It could allow remote command or code execution for an attacker with a low privilege account. Versions before 11.1.3.1 are affected, and Avaya's advisory resolves the issue by updating to 11.1.3.1.
What's affected
Avaya's advisory, which we retrieved, lists IP Office 11.1.3.0 and prior as affected and says to update to 11.1.3.1. The NVD record says all versions prior to 11.1.3.1. These agree.
Both give a base score of 9.9, with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. The difference from its sibling CVE-2024-4196, which scores 10.0, is one item: this flaw needs low privileges, so the attacker needs an account on the One-X service. Everything else is the same, and the scope change and full impact remain.
The NVD record flags no exploitation in the wild and the advisory says nothing about it either.
One-X is the end user client service of the product, so exposure depends on whether you run it and who can sign in.
How to check if you're exposed
Read the release number from your IP Office system. Anything at 11.1.3.0 or lower is in scope.
Then ask whether the One-X service is enabled and who can reach it. Review which users have accounts and whether any shared or default accounts remain. A low privilege requirement makes weak or recycled user passwords part of the risk.
Ask Avaya support which locations on the system hold uploaded content, and review them for files you do not recognise. Preserve anything suspicious for review before you delete it. You can also run a free in-browser dependency scan at gold.safeguard.sh/scan and browse the Gold directory for related entries.
What to do now
- Confirm the IP Office release and whether One-X is in use.
- Update to 11.1.3.1 or later, as Avaya's advisory directs.
- Limit access to the One-X service to the networks that need it, using firewalls and ACLs.
- Review user accounts, remove unused ones and reset credentials that look weak.
- Keep logs and any suspect uploaded files for the incident team before cleanup.
Why it matters
The weakness is CWE-434, unrestricted upload of a file with a dangerous type. When a service accepts files and does not control the name, type and storage location, an uploaded file can end up somewhere the server will run it. That is the path from a file upload to command execution.
Defenders can lean on two habits here. Keep management and collaboration services off the open internet, and treat any flaw that needs only a low privilege account as nearly as serious as one that needs none, since accounts are easy to obtain through phishing or reuse.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
How is this different from CVE-2024-4196?
That one is in the Web Control component and needs no login, scoring 10.0. This one is in One-X, needs a low privilege account and scores 9.9. One update to 11.1.3.1 addresses both, per the advisory.
Sources
- Avaya advisory ASA-2024-000 for IP Office, fetched for this review.
- Safeguard Gold entry for CVE-2024-4197
Last reviewed: 19 October 2026.
