CVE-2021-25654

Avaya Aura Device Services Arbitrary Code Execution Vulnerability

6.2 Medium

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may potentially allow a local user to execute specially crafted scripts. Affects 7.0 through 8.1.4.0 versions of Avaya Aura Device Services.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: High
Privileges needed: High
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: Low

Exploit likelihood

0.78%Up 0.4 points since Jun 26, 2021

What each source reports

CVE List Score used 6.2

Avaya Aura Device Services Arbitrary Code Execution Vulnerability

Record: CVE-2021-25654
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Weakness: CWE-378
Updated: 2026-11-02

EUVDEUVD-2021-12546 6.2

Record: EUVD-2021-12546
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-fx3v-mp3q-m7vg 7.8

An arbitrary code execution vulnerability was discovered in Avaya Aura Device Services that may...

Record: GHSA-fx3v-mp3q-m7vg
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-94
Updated: 2026-11-02

NVD 6.2

Record: CVE-2021-25654
CVSS 3.1: 6.2 MediumCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:L
CVSS 3.1: 7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 4.6 MediumAV:L/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-378
Updated: 2026-11-02

Affected products

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-25654 is a medium vulnerability (CVSS 6.2) in Avaya Aura Device Services, published June 25, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. No source names a fixed version.