CVE-2019-7003: SQL Injection in Avaya Control Manager

The impact of CVE-2019-7003 is severe. Successful exploitation allows an attacker to bypass authentication and directly interact with the underlying database. This could result in the unauthorized retrieval of usernames, passwords, configuration details, and other sensitive information stored within the Avaya Control Manager database. Depending on the database schema, an attacker might even be able to modify data or execute commands on the system. The lack of authentication requirements significantly broadens the attack surface, making this vulnerability particularly concerning. While no direct precedent is cited, the potential for data exfiltration and system compromise aligns with the impact of other high-severity SQL injection vulnerabilities.

1. Reserved2019-01-28
2. Published2019-07-11
3. Modified2024-09-17
4. EPSS updated2026-04-02

The primary mitigation for CVE-2019-7003 is to upgrade Avaya Control Manager to version 8.0.4.0 or later. If immediate upgrading is not feasible, consider implementing temporary workarounds such as restricting network access to the reporting component and implementing strict input validation on all user-supplied data. Web Application Firewalls (WAFs) configured with rules to detect and block SQL injection attempts can provide an additional layer of defense. Monitor Avaya Control Manager logs for suspicious SQL queries or database activity. After upgrading, confirm the fix by attempting a SQL injection attack on the reporting component and verifying that it is blocked.