CISA Adds Two Known Exploited Vulnerabilities to Catalog

CISA has added two new vulnerabilities to its Known Exploited Vulnerabilities Catalog, based on evidence of active exploitation. CVE-2025-24200link is external Apple iOS and iPadOS Incorrect Authorization Vulnerability CVE-2024-41710link is external Mitel SIP Phones Argument Injection Vulnerabili...

Mitel SIP Phones Argument Injection Vulnerability

Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the...

CVE-2025-23094

The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and earlier could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A...

CVE-2025-23094

The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and earlier could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A...

CVE-2025-23093

The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an...

Mitel OpenScape 4000和OpenScape 4000 Manager 安全漏洞

Mitel OpenScape 4000 and Mitel OpenScape 4000 Manager are both products of Mitel Corporation of Canada.Mitel OpenScape 4000 is a hybrid IP communications platform.Mitel OpenScape 4000 Manager is a management platform. A security vulnerability exists in Mitel OpenScape 4000 and Mitel OpenScape 400...

CVE-2025-23093

The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an...

CVE-2025-23093

The issue (CVE-2025-23093) affects Mitel OpenScape 4000 and OpenScape 4000 Manager. The root cause is the platform’s execution of a resource with unnecessary privileges, allowing an authenticated attacker to escalate privileges and execute arbitrary commands with elevated rights. Affected version...

CVE-2025-23093

The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager through V10 R1.54.1 and V11 through R0.22.1 could allow an authenticated attacker to conduct a privilege escalation attack due to the execution of a resource with unnecessary privileges. A successful exploit could allow an...

Mitel OpenScape 4000和OpenScape 4000 Manager 安全漏洞

Mitel OpenScape 4000 and Mitel OpenScape 4000 Manager are both products of Mitel Corporation of Canada.Mitel OpenScape 4000 is a hybrid IP communications platform.Mitel OpenScape 4000 Manager is a management platform. A security vulnerability exists in Mitel OpenScape 4000 and OpenScape 4000...

CVE-2025-23094

The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and earlier could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A...

CVE-2025-23094

The Platform component of Mitel OpenScape 4000 and OpenScape 4000 Manager V11 R0.22.0 through V11 R0.22.1, V10 R1.54.0 through V10 R1.54.1, and V10 R1.42.6 and earlier could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A...

CVE-2025-23094

The CVE-2025-23094 issue affects Mitel OpenScape 4000 and OpenScape 4000 Manager Platform component. It enables an unauthenticated attacker to perform a command injection due to insufficient parameter sanitization, allowing execution of arbitrary commands at the same privilege level as the web ac...

New Aquabot Botnet Exploits CVE-2024-41710 in Mitel Phones for DDoS Attacks

A Mirai botnet variant dubbed Aquabot has been observed actively attempting to exploit a medium-severity security flaw impacting Mitel phones in order to ensnare them into a network capable of mounting distributed denial-of-service DDoS attacks. The vulnerability in question is CVE-2024-41710 CVS...

PT-2025-4822 · Mitel · Mitel Openscape 4000 Manager +1

Name of the Vulnerable Software and Affected Versions: Mitel OpenScape 4000 versions V10 R1.54.1 and earlier Mitel OpenScape 4000 Manager versions V10 R1.54.1 and earlier Mitel OpenScape 4000 versions V11 through R0.22.1 Mitel OpenScape 4000 Manager versions V11 through R0.22.1 Description: The...

VulnCheck KEV: CVE-2024-41710

Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the...

PT-2025-4823 · Mitel · Mitel Openscape 4000 +1

Name of the Vulnerable Software and Affected Versions: Mitel OpenScape 4000 and OpenScape 4000 Manager versions V11 R0.22.0 through V11 R0.22.1 Mitel OpenScape 4000 and OpenScape 4000 Manager versions V10 R1.54.0 through V10 R1.54.1 Mitel OpenScape 4000 and OpenScape 4000 Manager versions V10...

The vulnerability of the Mitel MiCollab collaboration platform, related to an incorrect restriction on the path name to the restricted access catalog, allows a hacker to read arbitrary files.

The vulnerability of the Mitel MiCollab collaboration platform lies in an incorrect restriction on the path name used to access the restricted catalog. Exploiting this vulnerability could allow an attacker to read arbitrary files...

CISA Flags Critical Flaws in Mitel and Oracle Systems Amid Active Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Tuesday added three flaws impacting Mitel MiCollab and Oracle WebLogic Server to its Known Exploited Vulnerabilities KEV catalog, citing evidence of active exploitation. The list of vulnerabilities is as follows - CVE-2024-41713 CV...

Mitel MiCollab Path Traversal Vulnerability

Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access. This vulnerability can be chained with CVE-2024-55550, which allows an unauthenticated, remote attacker to read arbitrary files on the server...