Mitel 6869i SIP Security Vulnerability

Mitel 6869i SIP is a powerful and scalable desk phone from Mitel Canada. A security vulnerability exists in Mitel 6869i versions 4.5.0.41 and earlier, 5.0.0.1018 and earlier, which stems from the provis.html endpoint that does not clean up the hostname parameter, and can be exploited by an attack...

PT-2024-9269 · Mitel · Mitel 6869I

Name of the Vulnerable Software and Affected Versions: Mitel 6869i versions 4.5.0.41 and earlier Mitel 6869i versions 5.x through 5.0.0.1018 Description: A command injection issue exists in the hostname parameter taken in by the "provis.html" endpoint. The "provis.html" endpoint performs no...

CVE-2024-37569

CVE-2024-37569 affects Mitel 6869i SIP Phone (versions 4.5.0.41 and 5.x up to 5.0.0.1018). A command injection exists in the hostname parameter of the provis.html endpoint; the endpoint does not sanitize the hostname, writing it to disk and executing it during boot as part of shell commands. This...

Mitel 6869i Security Vulnerability

The Mitel 6869i SIP is a powerful and scalable desk phone from Mitel Canada. A security vulnerability exists in Mitel 6869i version 4.5.0.41, which stems from a failure of the upgrade.html page to clean up the username, path parameters prior to attaching flags to the busybox ftpget command,...

CVE-2024-37570

On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update upgrade.html page does not perform sanitization on the username and path parameters sent by an authenticated user before appending flags to the busybox ftpget command. This leads to $ command execution...

CVE-2024-37570

CVE-2024-37570 affects Mitel 6869i, firmware 4.5.0.41. The issue arises in the Manual Firmware Update page (upgrade.html), which fails to sanitize username and path parameters before appending to the busybox ftpget command, enabling $() command execution by an authenticated user. Impact is descri...

Exploit for Command Injection in Mitel 6869I_Sip_Firmware

CVE A repository containing exploit code / zero-day research I...

CVE-2024-35284

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient input validation...

CVE-2024-35283

A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting XSS attack due to insufficient input validation...

CVE-2024-35283

A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting XSS attack due to insufficient input validation...

CVE-2024-35284

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient input validation...

CVE-2024-35284

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting XSS attack due to insufficient input validation...

CVE-2024-35284

CVE-2024-35284 affects Mitel MiContact Center Business through version 10.0.0.4, specifically in the legacy chat component where insufficient input validation enables a reflected XSS when exploited by an unauthenticated attacker. The issue is confirmed by PT-2024-26416, which ties the vulnerabili...

CVE-2024-35283

A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting XSS attack due to insufficient input validation...

CVE-2024-35283

CVE-2024-35283 affects the Mitel MiContact Center Business Ignite component. Affected software: MiContact Center Business versions through 10.0.0.4. Description in connected docs shows a vulnerability due to insufficient input validation that could allow an unauthenticated attacker to perform a s...

CVE-2024-35283

A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-site scripting XSS attack due to insufficient input validation...

Mitel MiContact Center Business 跨站脚本漏洞

Mitel MiContact Center Business is an all-media contact center platform from Canadian company Mitel. The platform is used in customer communication, production management and other scenarios. A cross-site scripting vulnerability exists in Mitel MiContact Center Business version 10.0.0.4, which is...

PT-2024-26415 · Mitel · Mitel Micontact Center Business

Name of the Vulnerable Software and Affected Versions: Mitel MiContact Center Business versions through 10.0.0.4 Description: The issue is related to a stored cross-site scripting XSS attack due to insufficient input validation in the Ignite component. This could allow an unauthenticated attacker...

Mitel MiContact Center Business 跨站脚本漏洞

Mitel MiContact Center Business is an all-media contact center platform from Canadian company Mitel. The platform is used in customer communication, production management and other scenarios. A cross-site scripting vulnerability exists in Mitel MiContact Center Business version 10.0.0.4, which is...

PT-2024-26416 · Mitel · Mitel Micontact Center Business

Name of the Vulnerable Software and Affected Versions: Mitel MiContact Center Business versions through 10.0.0.4 Description: The issue is related to a reflected cross-site scripting XSS attack in the legacy chat component due to insufficient input validation, allowing an unauthenticated attacker...