Avaya Aura Device Services - OS Command Injection

An OS command injection vulnerability was found in the Avaya Aura Device Services Web application which could allow remote code execution as the Web server user via a malicious uploaded file. This issue affects Avaya Aura Device Services version 8.1.4.0 and earlier. id: CVE-2023-3722 info: name:...

CVE-2023-3722

creationtimestamp| type| source ---|---|--- 2024-11-19 19:43:20+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/9091 2025-06-12 21:02:26+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lrgszikoaa24 2026-08-10 11:00:29+00:00| exploited|...

Exploit for Unrestricted Upload of File with Dangerous Type in Avaya Aura_Device_Services

CVE-2023-3722 Python POC for CVE-2023-3722 Avaya Aura Device S...

CVE-2023-3722

A critical OS command injection vulnerability exists in the Avaya Aura Device Services Web application (version 8.1.4.0 and earlier ). The root cause is an unrestricted file upload feature that allows an unauthenticated attacker to upload malicious PHP files. By exploiting this, an attacker can a...