CVE-2024-41710

HIGHCISA KEV

7.2

Descricao

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

Detalhes CVE

Pontuacao CVSS v3.17.2

SeveridadeHIGH

Vetor CVSSCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Vetor de ataqueNETWORK

ComplexidadeLOW

Privilegios necessariosHIGH

Interacao do usuarioNONE

Publicado8/12/2024

Ultima modificacao11/5/2025

Fontekev

Avistamentos honeypot0

CISA KEV

FornecedorMitel

ProdutoSIP Phones

Nome da vulnerabilidadeMitel SIP Phones Argument Injection Vulnerability

Data inclusao KEV2025-02-12

Prazo de remediacao2025-03-05

Uso em ransomwareUnknown

Produtos afetados

mitel:6863i_sipmitel:6863i_sip_firmwaremitel:6865i_sipmitel:6865i_sip_firmwaremitel:6867i_sipmitel:6867i_sip_firmwaremitel:6869i_sipmitel:6869i_sip_firmwaremitel:6873i_sipmitel:6873i_sip_firmwaremitel:6905_sipmitel:6905_sip_firmwaremitel:6910_sipmitel:6910_sip_firmwaremitel:6915_sipmitel:6915_sip_firmwaremitel:6920_sipmitel:6920_sip_firmwaremitel:6920w_sipmitel:6920w_sip_firmwaremitel:6930_sipmitel:6930_sip_firmwaremitel:6930w_sipmitel:6930w_sip_firmwaremitel:6940_sipmitel:6940_sip_firmwaremitel:6940w_sipmitel:6940w_sip_firmwaremitel:6970mitel:6970_firmware

Fraquezas (CWE)

CWE-88CWE-88

Referencias

https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md(cve@mitre.org)

https://www.mitel.com/support/security-advisories(cve@mitre.org)

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019(cve@mitre.org)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41710(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlacoes IOC

Sem correlacoes registradas

This product uses data from the NVD API but is not endorsed or certified by the NVD.