Mitel Product Security Advisory 22-0004

Mitel Product Security Advisory 22-0004

Mitel 6800 Series SIP Phone and 6900 Series SIP Phone Access Control Vulnerability

Advisory ID: 22-0004

Publish Date: 2022-05-03

Last Updated: 2022-05-03

Revision: 1.0

Summary

An access control vulnerability has been identified in Mitel 6800 Series SIP Phones and 6900 Series SIP phones (excluding the 6970) running SIP firmware. If successfully exploited could allow a malicious actor access to code execution.

Mitel is recommending customers with affected product versions apply the available remediation.

This vulnerability was privately reported to Mitel.

Credit is given to Moritz Abrell of SySS GmbH for highlighting the issue and bringing to our attention.

Affected Products

Product NameProduct VersionSecurity BulletinLast Updated
Mitel 6800/6900 Series SIP PhonesRel 5.1 SP8 and earlier
Rel 6.0 to 6.1 HF4
22-0004-0012022-05-03

The vulnerability impacts all 6800 and 6900 Series SIP phones excluding the 6970 model.

Risk Assessment

The risk of this vulnerability is rated as Medium.

This vulnerability relates to Mitel 6800 Series SIP Phones and 6900 Series SIP Phones firmware (excluding 6970).

Refer to the product Security Bulletin for additional statements regarding risk.

Mitigation / Recommended Action

Mitel has issued a new release of the affected firmware. Customers are advised to update their 6800 IP and 6900 IP Phones to the latest version.

Customers are advised to review the product Security Bulletin.

For additional information, contact Product Support.

Related CVEs / CWEs / Advisories

CVE-2022-29855

Revision History

VersionDateDescription
1.02022-05-03Initial Version

Stay One Step Ahead Get notifications of the latest security advisories sent right to your inbox every week!