CVE-2025-1041 is a critical improper input validation flaw, scored 9.9, in Avaya Call Management System. A specially crafted web request could run an unauthorised remote command on the server. Avaya's fix is to upgrade to 19.2.0.7 or later, or 20.0.1.0 or later.
What's affected
Avaya advisory ASA-2025-001, released on 9 June 2025, covers Avaya Call Management System (CMS), the reporting and analysis product for contact centres. The affected versions are 18.x up to 19.2.0.6, and 20.0 up to 20.0.0.x. The NVD description puts it as 18.x, 19.x prior to 19.2.0.7, and 20.x prior to 20.0.1.0.
The resolution in the advisory is specific. For 18.x to 19.2.0.6, upgrade to 19.2.0.7 or later. For 20.0 to 20.0.0.x, upgrade to 20.0.1.0 or later. Avaya classifies the advisory as critical.
The record does not mark this CVE as known exploited, and the advisory I read does not report attacks. Avaya's own wording is that the flaw could allow an unauthorised remote command through a specially crafted web request.
How to check if you're exposed
Find out which CMS release each of your servers runs. Avaya CMS administrators can check the version from the system itself using Avaya's documented procedure. Use the version listed in the advisory as the baseline: anything 18.x, 19.x below 19.2.0.7, or 20.0 below 20.0.1.0 is in scope. If you cannot confirm the exact version, read the advisory's information column and ask Avaya support.
Then check who can reach the CMS web interface. A flaw reachable through a web request is a problem mainly where that interface is reachable. List the networks that can connect to the CMS server and check whether any are untrusted or broad.
Finally, check whether your CMS is managed by a partner or a service provider. If so, ask them in writing which version runs and when they will upgrade.
What to do now
- Identify every Avaya CMS server and its version.
- Upgrade 18.x and 19.x to 19.2.0.7 or later, and 20.0.0.x to 20.0.1.0 or later, using Avaya's documented process.
- Until the upgrade is done, follow Avaya's interim advice: restrict access with firewalls and ACLs, and apply physical and network security best practices.
- Do not change the CMS operating system or application in unapproved ways. Avaya warns that unapproved changes may void the service contract.
- Review access logs of the CMS web interface for unusual requests since the start of 2025.
- Record the change in your change log and tell the contact centre owners about the maintenance window.
Why it matters
The flaw is listed under CWE-20 (improper input validation). The web interface accepts input and does not check it well enough before acting on it, so a crafted request can lead to a command being run on the server. The score of 9.9 reflects network reach, low complexity, low privileges required and a changed scope, which means impact can extend beyond the vulnerable component.
Contact centre systems hold call records, agent data and reports, and they often sit close to telephony infrastructure. They are also the kind of system that gets updated rarely, because downtime is expensive. That is why the interim advice about access restrictions matters: reduce who can talk to the server while you wait for a window.
Treat this as a normal critical upgrade, scheduled with urgency.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Which Avaya CMS versions need action?
Versions 18.x through 19.2.0.6 and 20.0 through 20.0.0.x. Upgrade to 19.2.0.7 or later, or 20.0.1.0 or later, according to the advisory.
What can I do before the upgrade?
Restrict access with firewalls and ACLs, as Avaya recommends, and review web interface logs.
Sources
Last reviewed: 19 October 2026.
