CRITICAL✓ PATCH🇵🇱 Wersja polska

CVE-2023-31458

CVSS 9.8v3.1pub. 2023-05-24upd. 2025-01-31

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Mitel Mivoice Connect

    APP
    Mitel
    ≤ 22.24.1500.0
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Tags
Auth Bypass
CWE
References

Related vulnerabilities

CVE-2022-29499CRITICAL9.8⚠ KEVPL ✓same product

RCE w komponencie Service Appliance Mitel MiVoice Connect

CVE-2023-32748CRITICAL9.8PL ✓same product

Mitel MiVoice Connect — obejście uwierzytelniania w komponencie Linux DVS

CVE-2023-31457CRITICAL9.8PL ✓same product

Mitel MiVoice Connect — ominięcie autoryzacji w komponencie Headquarters

CVE-2020-10211CRITICAL9.8PL ✓same product

RCE w komponencie UCB Mitel MiVoice Connect — brak walidacji parametrów URL

CVE-2023-39289HIGH7.5same product

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could a...