Lucene search
+L

CVE-2025-47188

🗓️ 07 Aug 2025 00:00:00Reported by mitreType 
cve
 cve
🔗 web.nvd.nist.gov📰️ 9 Media mentions👁 147 Views

Vulnerability in Mitel SIP Phones allows command injection due to insufficient parameter sanitization

Related
Refs
Social
ReporterTitlePublishedViews
Family
circl
Circl
CVE-2025-47188
12 May 202501:52
circl
cnnvd
CNNVD
Mitel多款产品 安全漏洞
7 Aug 202500:00
cnnvd
cvelist
Cvelist
CVE-2025-47188
7 Aug 202500:00
cvelist
euvd
EUVD
EUVD-2025-23917
7 Aug 202500:00
euvd
nuclei
Nuclei
Mitel 6000 - OS Command Injection
3 Sep 202602:10
nuclei
nvd
NVD
CVE-2025-47188
7 Aug 202515:15
nvd
ptsecurity
Positive Technologies
PT-2025-20724
12 May 202500:00
ptsecurity
redhatcve
RedhatCVE
CVE-2025-47188
9 Aug 202500:23
redhatcve
thn
The Hacker News
⚡ Weekly Recap: Zero-Day Exploits, Developer Malware, IoT Botnets, and AI-Powered Scams
12 May 202512:10
thn
vulncheck_kev
VulnCheck KEV
VulnCheck KEV: CVE-2025-47188
21 Jul 202500:00
vulncheck_kev
Rows per page

syedaquib77

Vulnerability Alert: Multiple Vulnerabilities in Mitel SIP Phones (Command Injection, File Upload) Timeline: Disclosure: 2025-05-08, Patch: 2025-05-09 Attribution: Mirai Botnet CVE-ID: CVE-2025-47188 Base Score: 9.8 CVSS Metrics: AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H cvssSeverity: Critical EPSS Percentile: N/A Exploit Maturity: Not Available Affected Versions: - Mitel 6800 Series SIP Phones (firmware R6.4.0.SP4 and earlier) - Mitel 6900 Series SIP Phones (firmware R6.4.0.SP4 and earlier) - Mitel 6900w Series SIP Phones (firmware R6.4.0.SP4 and earlier) - Mitel 6970 Conference Unit (firmware R6.4.0.SP4 and earlier) Fixed Versions: - firmware version R6.4.0.SP5 or later Attack Vectors: - Command Injection - File Upload Summary: Two critical vulnerabilities, CVE-2025-47188 (Critical command injection) and CVE-2025-47187 (Medium unauthenticated file upload), affect several Mitel SIP phone series. CVE-2025-47188 allows remote, unauthenticated attackers on the same network to inject and execute arbitrary commands via insufficient parameter sanitization. CVE-2025-47187 permits unauthenticated attackers to upload arbitrary WAV files, potentially exhausting storage. These flaws expose enterprise networks to significant risk and have historical ties to Mirai botnet exploitation. Impact Scope: Vulnerable devices may lead to unauthorized access and data exposure. Recommended Actions: - Patch devices to firmware version R6.4.0.SP5 or later to mitigate these vulnerabilities. Related Resources: - https://t.co/KfwLyhij8G - https://t.co/XrKfQRWG8G Tags: #Mitel #SIPPhone #VoIP #CommandInjection #FileUpload #RemoteCodeExecution #CVE202547188 #CVE202547187 #CriticalVulnerability #MediumVulnerability #Cybersecurity

Data

Build on a solid foundation with Vulners data

We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data

Api

Power your application with Vulners API

The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access

App

Assess and manage vulnerabilities with Vulners tools

Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation

17 Jun 2026 09:27Current
9.1High risk
Vulners AI Score9.1
CVSS 3.16.5
EPSS0.50237
SSVC
147