CVE-2024-41710

Mitel SIP Phones Argument Injection Vulnerability

Mitel — SIP Phones

Added to KEV catalog: 12 February 2025
Federal remediation due date: 5 March 2025
Weakness classification (CWE): CWE-88

CISA Description

Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://www.mitel.com/-/media/mitel/file/pdf/support/security-advisories/security-bulletin_24-0019-001-v2.pdf ; https://nvd.nist.gov/vuln/detail/CVE-2024-41710

View on NVD View on MITRE CVE View full CISA catalog

More Mitel Vulnerabilities

CVE-2024-55550

Mitel MiCollab Path Traversal Vulnerability

CVE-2024-41713

Mitel MiCollab Path Traversal Vulnerability

CVE-2022-41223

Mitel MiVoice Connect Code Injection Vulnerability

CVE-2022-40765

Mitel MiVoice Connect Command Injection Vulnerability

CVE-2022-29499

Mitel MiVoice Connect Data Validation Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services