CVE-2024-41714

HIGH

Mitel MiCollab < 9.8.1.5 & MiVoice Business < 1.0.0.27 - Authenticated Command Injection

Title source: llm
STIX 2.1

Description

A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1.0.0.27 could allow an authenticated attacker to conduct a command injection attack, due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands with elevated privileges within the context of the system.

References (1)

Core 1

Scores

CVSS v3 8.8
EPSS 0.0127
EPSS Percentile 66.1%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-94
Status published
Products (2)
mitel/micollab < 9.8.1.5
mitel/mivoice_business_solution_virtual_instance < 1.0.0.27
Published Oct 21, 2024
Tracked Since Feb 18, 2026