Evil-DB LogoEvil-DB
← All CVEs

CVE-2024-41710

high · 7.2Actively exploited

On the CISA Known Exploited Vulnerabilities catalog

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Added 2025-02-12Remediation due 2025-03-05

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

7.2
CVSS
41.6%
EPSS (exploit prob.)
99th
EPSS percentile
2024-08-12
Published

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-88

Affected products

VendorProductAffected versions
mitel6970_firmware<= 6.4.0.136
mitel6970all versions
mitel6940w_sip_firmware<= 6.4.0.136
mitel6940w_sipall versions
mitel6930w_sip_firmware<= 6.4.0.136
mitel6930w_sipall versions
mitel6920w_sip_firmware<= 6.4.0.136
mitel6920w_sipall versions
mitel6920_sip_firmware<= 6.4.0.136
mitel6920_sipall versions
mitel6915_sip_firmware<= 6.4.0.136
mitel6915_sipall versions
mitel6910_sip_firmware<= 6.4.0.136
mitel6910_sipall versions
mitel6905_sip_firmware<= 6.4.0.136
mitel6905_sipall versions
mitel6940_sip_firmware<= 6.4.0.136
mitel6940_sipall versions
mitel6930_sip_firmware<= 6.4.0.136
mitel6930_sipall versions
mitel6873i_sip_firmware<= 6.4.0.136
mitel6873i_sipall versions
mitel6869i_sip_firmware<= 6.4.0.136
mitel6869i_sipall versions
mitel6867i_sip_firmware<= 6.4.0.136
mitel6867i_sipall versions
mitel6865i_sip_firmware<= 6.4.0.136
mitel6865i_sipall versions
mitel6863i_sip_firmware<= 6.4.0.136
mitel6863i_sipall versions

Check a specific version with /api/v1/cve/match.

References

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2024-41710