#Mitel

Mitel SIP Phones ✓Patched

Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system. Added to CISA KEV on 2025-02-12.

Mitel MiCollab ✓Patched

CVE-2024-41713: Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server. CVE-2024-55550: Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization. This vulnerability can be chained with CVE-2024-41713, which allows an unauthenticated, remote attacker to read arbitrary files on the server. Added to CISA KEV on 2025-01-07.

Mitel MiVoice Connect ✓Patched

The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. Added to CISA KEV on 2023-02-21. CISA lists known use in ransomware campaigns.