PT-2018-3340 · Mitel · Mitel Mivoice 5330E

Mattia Reggiani · Published 2018-09-25 · Updated 2019-01-25 · CVE-2018-15497

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Mitel MiVoice 5330e (affected versions not specified)

Description: The issue is related to memory corruption flaws in the SIP/SDP packet handling functionality. An attacker can exploit this remotely by sending a particular pattern of SIP/SDP packets, potentially causing a denial of service state in the affected devices and possibly allowing remote code execution.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2020-00074

CVE-2018-15497

Affected Products

Mitel Mivoice 5330E

References · 6

• 🔥 https://nccgroup.trust/uk/our-research/technical-advisory-mitel-mivoice-5330e-memory-corruption-flaw · Exploit
• https://osv.dev/vulnerability/CVE-2018-15497 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-15497 · Security Note
• https://bdu.fstec.ru/vul/2020-00074 · Security Note
• https://mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0009 · Vendor Advisory
• https://cxsecurity.com/cveshow/CVE-2018-15497 · Note