Mitel Mivoice Connect vulnerabilities

CVE-2022-29499 [CRITICAL] CWE-20 CVE-2022-29499: The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code executi The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

CVE-2022-41223 [MEDIUM] CWE-94 CVE-2022-41223: The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authen The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

CVE-2022-40765 [MEDIUM] CWE-77 CVE-2022-40765: A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) c A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

CVE-2023-31458 [CRITICAL] CVE-2023-31458: A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500 A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitr

CVE-2023-32748 [CRITICAL] CWE-863 CVE-2023-32748: The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.

CVE-2020-10211 [CRITICAL] CWE-20 CVE-2020-10211: A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 coul A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to execute arbitrary scripts due to insufficient validation of URL parameters. A successful exploit could allow an attacker to gain access to sensitive information.

CVE-2023-31457 [CRITICAL] CVE-2023-31457: A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22. A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.

CVE-2023-31459 [HIGH] CWE-640 CVE-2023-31459: A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208. A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to mak

CVE-2023-31460 [HIGH] CWE-77 CVE-2023-31460: A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 an A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parameters.

CVE-2023-39289 [HIGH] CWE-200 CVE-2023-39289: A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.1 A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker to access system information.

CVE-2023-25599 [HIGH] CWE-79 CVE-2023-25599: A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500. A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the test_presenter.php page. A successful exploit could allow an attacker to execute arbitrary scripts.

CVE-2018-9102 [MEDIUM] CWE-89 CVE-2018-9102: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21. A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct an SQL injection attack due to insufficient input validation for the signin interface. A successful exploit could allo

CVE-2023-39288 [MEDIUM] CWE-88 CVE-2023-39288: A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.1 A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit could allow an attacker to access network information

CVE-2023-39287 [MEDIUM] CWE-88 CVE-2023-39287: A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800. A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit could allow an attacker to access network information

CVE-2023-25598 [MEDIUM] CWE-79 CVE-2023-25598: A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21 A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the home.php page. A successful exploit could allow an attacker to execute arbitrary s

CVE-2018-9104 [MEDIUM] CWE-79 CVE-2018-9104: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21. A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the api.php page. A successful exploi

CVE-2018-9101 [MEDIUM] CWE-79 CVE-2018-9101: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21. A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the launch_presenter.php page. A succ

CVE-2018-9103 [MEDIUM] CWE-79 CVE-2018-9103: A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21. A vulnerability in the conferencing component of Mitel MiVoice Connect, versions R1707-PREM SP1 (21.84.5535.0) and earlier, and Mitel ST 14.2, versions GA27 (19.49.5200.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exp

CVE-2023-39291 [MEDIUM] CVE-2023-39291: A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 cou A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view system information.

CVE-2023-39290 [MEDIUM] CVE-2023-39290: A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800 A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration. A successful exploit could allow an attacker to view system information.