PT-2023-23340 · Mitel · Mitel Mivoice Connect

Jahmil Williams + 1 · Published 2023-05-24 · Updated 2023-06-01 · CVE-2023-31459

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Mitel MiVoice Connect versions 9.6.2208.101 and earlier

Description A vulnerability in the Connect Mobility Router component could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges. This is because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.

Recommendations For Mitel MiVoice Connect versions 9.6.2208.101 and earlier, ensure that a strong password is set for administrative access after the initial installation to prevent unauthorized access. Consider changing the default password to a unique and complex one to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-640

Related Identifiers

CVE-2023-31459

Affected Products

Mitel Mivoice Connect

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2023-31459 · Security Note
• https://mitel.com/support/security-advisories · Vendor Advisory
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-31459 · Vendor Advisory