Mitel Product Security Advisory 22-0003

Mitel Product Security Advisory 22-0003

Mitel 6900 Series IP Phone Access Control Vulnerability

Advisory ID: 22-0003

Publish Date: 2022-05-03

Last Updated: 2022-05-12

Revision: 2.0

Summary

An access control vulnerability has been identified in Mitel 6900 Series IP phones (excluding the 6970) running MiNet firmware. If successfully exploited could allow a malicious actor access to code execution.

Mitel is recommending customers with affected product versions apply the available remediation.

This vulnerability was privately reported to Mitel.

Credit is given to Moritz Abrell of SySS GmbH for highlighting the issue and bringing to our attention.

Affected Products

The vulnerability impacts all 6900 Series IP (MiNet) phones excluding the 6970 model.

Risk Assessment

The risk of this vulnerability is rated as Medium.

This vulnerability relates to Mitel 6900 IP Phones running MiNet firmware (excluding the 6970).

Refer to the product Security Bulletin for additional statements regarding risk.

Mitigation / Recommended Action

Mitel has issued a new release of the affected firmware. Customers are advised to update their 6900 IP Phones to the latest version.

Customers are advised to review the product Security Bulletin.

For additional information, contact Product Support.

Related CVEs / CWEs / Advisories

CVE-2022-29854

Revision History