CVE-2024-37570

CVE-2024-37570 affects Mitel 6869i, firmware 4.5.0.41. The issue arises in the Manual Firmware Update page (upgrade.html), which fails to sanitize username and path parameters before appending to the busybox ftpget command, enabling $() command execution by an authenticated user. Impact is descri...

Hackers Abuse Mitel Devices to Amplify DDoS Attacks by 4 Billion Times

Threat actors have been observed abusing a high-impact reflection/amplification method to stage sustained distributed denial-of-service DDoS attacks for up to 14 hours with a record-breaking amplification ratio of 4,294,967,296 to 1. The attack vector – dubbed TP240PhoneHome CVE-2022-26143 – has...