PT-2022-20929 · Mitel · Mivoice Business Express+1

Published 2022-06-17 · Updated 2022-06-30 · CVE-2022-31784

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MiVoice Business versions through 9.3 PR1 MiVoice Business Express versions through 8.0 SP3 PR3

Description A vulnerability in the management interface could allow an unauthenticated attacker with network access to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution.

Recommendations For MiVoice Business versions through 9.3 PR1, update to a version later than 9.3 PR1 to resolve the issue. For MiVoice Business Express versions through 8.0 SP3 PR3, update to a version later than 8.0 SP3 PR3 to resolve the issue. As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-120

Related Identifiers

CVE-2022-31784

Affected Products

Mivoice Business

Mivoice Business Express

References · 5

• https://osv.dev/vulnerability/CVE-2022-31784 · Vendor Advisory
• https://mitel.com/support/security-advisories · Vendor Advisory
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-22-0005 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-31784 · Security Note
• https://t.me/cibsecurity/44722 · Telegram Post