HIGH

CVE-2024-41710

Mitel 6970 Firmware 2024-08-12 CVSS v3.1

CVSS

7.2

KEV

Description

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

Summary dbcve.org

This is an argument injection vulnerability in Mitel 6800/6900 Series SIP phones allowing an authenticated attacker with administrative privileges to inject arbitrary arguments during the boot process due to insufficient parameter sanitization, leading to arbitrary command execution within the system context.

Mitigation

Upgrade Mitel SIP phone firmware to a version beyond R6.4.0.HF1. Additionally, restrict administrative access to trusted personnel and monitor for unauthorized admin sessions.

Proof of Concept

Weakness (CWE)

CWE-88

EPSS Score

41.65%

Probability of exploitation in next 30 days

98.7th percentile

References

https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md Exploit, Third Party Advisory https://www.mitel.com/support/security-advisories Vendor Advisory https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019 Vendor Advisory https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41710 US Government Resource

View on dbcve.org

Base CVE data derived from NVD (public domain). Enrichment by dbcve.org (CC-BY-4.0). Fetched via API.

Back to CVE