Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. Required action: Apply updates per vendor instructions.
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. Required action: Apply updates per vendor instructions.
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation. Required action: Apply updates per vendor instructions.
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system. Required action: Apply updates per vendor instructions.
CVE-2022-26143EPSS 87.6%MiCollab, MiVoice Business ExpressMitel