PT-2024-9270 · Mitel · Mitel 6869I

Kyle Burns

·

Published

2024-06-09

·

Updated

2024-10-25

·

CVE-2024-37570

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:S/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Mitel 6869i version 4.5.0.41
Description: The issue is related to the Manual Firmware Update (upgrade.html) page, which does not perform sanitization on the username and path parameters sent by an authenticated user. This lack of sanitization leads to $() command execution, allowing a remote attacker to execute arbitrary commands by sending specially crafted POST requests.
Recommendations: For Mitel 6869i version 4.5.0.41, as a temporary workaround, consider disabling access to the Manual Firmware Update (upgrade.html) page until a patch is available. Restrict access to the upgrade.html page to minimize the risk of exploitation. Avoid using the username and path parameters in the affected page until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-10958
CVE-2024-37570

Affected Products

Mitel 6869I