A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (
Affects Mitel 6800, 6900, and 6900w Series SIP Phones and the 6970 Conference Unit at R6.4.0.HF1 (R6.4.0.136) and earlier. The checked facts list no fixed release.
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Listed in CISA KEV
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Actively exploited
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The affected software is the firmware of Mitel 6800 Series, 6900 Series, and 6900w Series SIP desk phones, including the 6970 Conference Unit. An attacker with administrative access to a phone could exploit improper input handling during startup to run arbitrary commands on the device.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.
Timeline
- CVE published
- Added to CISA KEV
CISA has evidence of exploitation in the wild
- CISA remediation deadline
Due date for US federal agencies to patch
- Record last updated
- EPSS reached 10%
FIRST estimates at least a 10% chance of exploitation in the next 30 days
Affected versions
- n/a n/a
Version range not reported
References 3
Questions about CVE-2024-41710
What does this mean?
The flaw could allow a malicious actor to execute arbitrary commands within the context of the phone, including gaining root access to the device.Source: mitel.com
Am I affected, and how do I check?
The listed products are affected at firmware R6.4.0.HF1 (R6.4.0.136) and earlier. Check the firmware version shown on the phone or in its administration interface against that release.Source: mitel.com
What should I do about it?
The checked facts do not name a fixed release to upgrade to. Check the vendor's advisory for a fixed firmware version before taking action.Source: mitel.com
Is it being exploited?
Yes. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-02-12, which means it has evidence of attacks. No public exploit code is tracked.Source: cisa.gov, cve.now feed data
What if there's no patch?
The checked facts do not include a workaround or a limit on the affected feature. Consult the vendor's advisory for any interim mitigation.Source: mitel.com