WWBN AVideo's Scheduler/downloadICS.php endpoint accepts attacker-controlled parameters (title, description, joinURL) that are passed to Scheduler::downloadICS(), which generates ICS calendar files using the ICS helper class. The ICS::escape_string() function escapes commas and semicolons but does not neutralize carriage return and line feed (CRLF) characters. This allows attackers to inject CRLF sequences that break out of intended ICS properties and insert arbitrary ICS lines, including new VEVENT entries. As the malicious ICS file is served from the victim's trusted AVideo origin, this enables attackers to create forged calendar events with attacker-chosen details, facilitating credible calendar phishing attacks. A code commit (764db592f99e545aa86bb9a4ad664ffd14c38ba5) addresses this issue, but no official patch release or vendor advisory is provided yet.

The vulnerability enables attackers to craft malicious ICS files that, when imported by victims, add attacker-controlled calendar events. These forged events can include misleading SUMMARY, URL, LOCATION, and DESCRIPTION fields, potentially leading to successful calendar phishing attacks. There is no direct confidentiality or availability impact reported. The CVSS score of 4.3 reflects a medium severity with low complexity and no privileges required, but user interaction is needed to import the malicious calendar file.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. A code commit fixing the issue exists, indicating a fix is available in the source repository. Until an official patch is released, users should avoid importing ICS files generated by affected versions from untrusted sources. Monitor the vendor's official channels for an official fix or update.