PT-2025-20724 · Mitel · Mitel Sip Phones

Marc Bollhalder

·

Published

2025-05-12

·

Updated

2025-12-10

·

CVE-2025-47188

CVSS v3.1

6.5

Medium

VectorAV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Name of the Vulnerable Software and Affected Versions Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones versions through 6.4 SP4 (R6.4.0.4006) Mitel 6970 Conference Unit versions through 6.4 SP4 (R6.4.0.4006) and version V1 R0.1.0
Description A command injection issue exists in Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit. The issue is due to insufficient input sanitization, allowing an unauthenticated attacker to execute arbitrary commands within the context of the phone. Successful exploitation could lead to the disclosure or modification of sensitive configuration data, or impact device availability and operation. The vulnerability has been actively exploited since May 2025.
Recommendations Update Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones to a version later than 6.4 SP4 (R6.4.0.4006). Update Mitel 6970 Conference Unit to a version later than 6.4 SP4 (R6.4.0.4006) or V1 R0.1.0.

Fix

RCE

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2025-47188

Affected Products

Mitel Sip Phones