PT-2023-26870 · Mitel · Mitel Mivoice Connect

Jahmil Williams + 1 · Publicado 2023-08-25 · Atualizado 2023-08-31 · CVE-2023-39288

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mitel MiVoice Connect versions through 9.6.2304.102

Description A vulnerability in the Connect Mobility Router component could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit could allow an attacker to access network information and to generate excessive network traffic.

Recommendations For Mitel MiVoice Connect versions through 9.6.2304.102, consider updating to a version that addresses the command argument injection issue in the Connect Mobility Router component to prevent exploitation. As a temporary workaround, restrict internal network access and ensure that only authorized personnel have elevated privileges to minimize the risk of exploitation.

Correção

Argument Injection

Enumeração de Fraquezas

CWE-88

Identificadores relacionados

CVE-2023-39288

Produtos afetados

Mitel Mivoice Connect

Referências · 12

• https://twitter.com/CVEnew/status/1695352903157125530 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1695349765024670103 · Publicação no Twitter
• https://twitter.com/VulmonFeeds/status/1695237075883213306 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1695536263330500759 · Publicação no Twitter
• https://t.me/cibsecurity/69233 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-39288 · Aviso do Fabricante
• https://twitter.com/TechFishNews/status/1695233651074814036 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1695532857744109594 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2023-39288 · Nota de Segurança
• https://mitel.com/support/security-advisories · Aviso do Fabricante
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-23-0011 · Aviso do Fabricante
• https://t.me/cvenotify/57374 · Publicação no Telegram