Mitel Product Security Advisory 22-0003
Mitel Product Security Advisory 22-0003
Mitel 6900 Series IP Phone Access Control Vulnerability
Advisory ID: 22-0003
Publish Date: 2022-05-03
Last Updated: 2022-05-12
Revision: 2.0
Summary
An access control vulnerability has been identified in Mitel 6900 Series IP phones (excluding the 6970) running MiNet firmware. If successfully exploited could allow a malicious actor access to code execution.
Mitel is recommending customers with affected product versions apply the available remediation.
This vulnerability was privately reported to Mitel.
Credit is given to Moritz Abrell of SySS GmbH for highlighting the issue and bringing to our attention.
Affected Products
Product Name | Product Version | Security Bulletin | Last Updated |
---|---|---|---|
Mitel 6900 Series IP (MiNet) Phones | MiNet 1.8.0.12 and earlier | 22-0003-001 | 2022-05-12 |
The vulnerability impacts all 6900 Series IP (MiNet) phones excluding the 6970 model.
Risk Assessment
The risk of this vulnerability is rated as Medium.
This vulnerability relates to Mitel 6900 IP Phones running MiNet firmware (excluding the 6970).
Refer to the product Security Bulletin for additional statements regarding risk.
Mitigation / Recommended Action
Mitel has issued a new release of the affected firmware. Customers are advised to update their 6900 IP Phones to the latest version.
Customers are advised to review the product Security Bulletin.
For additional information, contact Product Support.
Related CVEs / CWEs / Advisories
CVE-2022-29854
Revision History
Version | Date | Description |
---|---|---|
1.0 | 2022-05-03 | Initial Version |
2.0 | 2022-05-12 | Updated security bulletin |