Command Injection in Mitel products - CVE-2024-41710
Published: July 22, 2024 / Updated: February 12, 2025
Vulnerability identifier: #VU94634
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-41710
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote user to execute arbitrary commands on the target system.
The vulnerability exists due to improper input validation in the Boot Process. A remote administrator can pass specially crafted data to the application and execute arbitrary commands on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
6800 Series SIP Phones
6900w Series SIP Phone
6900 Series SIP Phones
6970 Conference Unit
6900w Series SIP Phone
6900 Series SIP Phones
6970 Conference Unit
How to mitigate CVE-2024-41710
Install updates from vendor's website.
6800 Series SIP Phones - update to R6.4.0.HF2 (R6.4.0.137)
6900w Series SIP Phone - update to R6.4.0.HF2 (R6.4.0.137)
6900 Series SIP Phones - update to R6.4.0.HF2 (R6.4.0.137)
6970 Conference Unit - update to R6.4.0.HF2 (R6.4.0.137)
6900w Series SIP Phone - update to R6.4.0.HF2 (R6.4.0.137)
6900 Series SIP Phones - update to R6.4.0.HF2 (R6.4.0.137)
6970 Conference Unit - update to R6.4.0.HF2 (R6.4.0.137)