CVE-2022-38168

PoC —

CVSS 3.1

9.1 critical

EPSS

1%p64

Published

Nov 3, 2022 (Nov 3, 2022)

Modified

Jun 17, 2026

Description

Broken Access Control in User Authentication in Avaya Scopia Pathfinder 10 and 20 PTS version 8.3.7.0.4 allows remote unauthenticated attackers to bypass the login page, access sensitive information, and reset user passwords via URL modification.

Vendors: avaya
Products: scopia pathfinder 10 pts firmware, scopia pathfinder 20 pts firmware
Weakness: CWE-306
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

NVD CVE.org GitHub PoCs EPSS (1.1%)

In the news0 stories

No ingested article mentions this CVE yet.