mitel Vulnerabilities and Affected Products
Vulnerabilities associated with mivoice_business_solutions_virtual_instance.
Products
Clear product- micollab12 vulnerabilities
- 6800_series_sip_phones5 vulnerabilities
- 6900_series_sip_phones4 vulnerabilities
- 6900w_series_sip_phone3 vulnerabilities
- 6970_conference_unit3 vulnerabilities
- MiVoice Connect3 vulnerabilities
- micontact_center_business2 vulnerabilities
- mivoice_business_solutions_virtual_instance2 vulnerabilities
- mivoice_office_4002 vulnerabilities
- mivoice_office_400_smb_controller_firmware2 vulnerabilities
- 6800 Series/6900 Series/6900w Series SIP Phones and 6970 Conference Unit1 vulnerability
- 6800_series_firmware1 vulnerability
- 6869i_firmware1 vulnerability
- 6900_series_firmware1 vulnerability
- 6900w_series_firmware1 vulnerability
- 6905_sip_firmware1 vulnerability
- 6910_sip_firmware1 vulnerability
- 6915_sip_firmware1 vulnerability
- 6920_sip_firmware1 vulnerability
- 6920w_sip_firmware1 vulnerability
- 6930w_sip_firmware1 vulnerability
- 6940_sip_firmware1 vulnerability
- 6940w_sip_firmware1 vulnerability
- 69701 vulnerability
- 6970_conference_firmware1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2024-41714HIGH | A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges within the context of the system. CWE-94Oct 21, 2024 | CVSS8.8v3.1 | EPSS1.31% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2024-35314CRITICAL | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts. CWE-94Oct 21, 2024 | CVSS9.8v3.1 | EPSS1.8% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |