PT-2023-26870 · Mitel · Mitel Mivoice Connect

Jahmil Williams + 1 · Published 2023-08-25 · Updated 2023-08-31 · CVE-2023-39288

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L

Name of the Vulnerable Software and Affected Versions Mitel MiVoice Connect versions through 9.6.2304.102

Description A vulnerability in the Connect Mobility Router component could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit could allow an attacker to access network information and to generate excessive network traffic.

Recommendations For Mitel MiVoice Connect versions through 9.6.2304.102, consider updating to a version that addresses the command argument injection issue in the Connect Mobility Router component to prevent exploitation. As a temporary workaround, restrict internal network access and ensure that only authorized personnel have elevated privileges to minimize the risk of exploitation.

Fix

Argument Injection

Weakness Enumeration

CWE-88

Related Identifiers

CVE-2023-39288

Affected Products

Mitel Mivoice Connect

References · 12

• https://osv.dev/vulnerability/CVE-2023-39288 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-39288 · Security Note
• https://mitel.com/support/security-advisories · Vendor Advisory
• https://mitel.com/support/security-advisories/mitel-product-security-advisory-23-0011 · Vendor Advisory
• https://twitter.com/CVEnew/status/1695352903157125530 · Twitter Post
• https://twitter.com/CVEnew/status/1695349765024670103 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1695237075883213306 · Twitter Post
• https://twitter.com/CVEnew/status/1695536263330500759 · Twitter Post
• https://t.me/cibsecurity/69233 · Telegram Post
• https://twitter.com/TechFishNews/status/1695233651074814036 · Twitter Post
• https://twitter.com/CVEnew/status/1695532857744109594 · Twitter Post
• https://t.me/cvenotify/57374 · Telegram Post