A stack-based buffer overflow flaw in the Dynamic Host Configuration Protocol (DHCP) client discovered and fixed ten years ago is still affecting several Avaya phones. The vulnerability, tracked as CVE-2009-0692, could be exploited by an attacker to crash the ISC DHCP client and execute arbitrary code with the permissions of the client. Avaya did not address the vulnerability issue in some of its VoIP devices by applying the necessary patches that were released after the discovery of the flaw in 2009.”]
Source: https://securityaffairs.co/wordpress/89710/hacking/avaya-voip-rce.html