Mitel Product Security Advisory MISA-2026-0009
OpenScape Endpoint Management Authentication Bypass and Privilege Escalation Vulnerabilities
Advisory ID: MISA-2026-0009
First Issue Date: 2026-10-28
Last Updated: 2026-10-28
Revision: 1.0
Summary
An authentication bypass vulnerability, MTLVULN-1788, has been identified in the Node-RED component of OpenScape Endpoint Management which, if successfully exploited, could allow an unauthenticated attacker could allow an unauthenticated attacker to gain unauthorized access to Node-RED due to insufficient validation of redirect URLs and improper authentication controls. A successful exploit of this vulnerability requires user interaction and could allow an attacker to gain unauthorized administrative access to Node-RED. The vulnerability severity is rated as high.
A privilege escalation vulnerability, MTLVULN-1789, has been identified in the Node-RED component of OpenScape Endpoint Management which, if successfully exploited, could allow an authenticated attacker with administrative privileges to execute arbitrary commands with elevated privileges due to the execution of a resource with unnecessary privileges. A successful exploit of this vulnerability could allow an attacker to execute arbitrary commands with elevated privileges. The vulnerability severity is rated as high.
Mitel is recommending customers with affected product versions update to the latest release.
Credit is given to Rodrigo Duarte Garcia of Telefónica Tech, for highlighting these issues and bringing these to our attention.
Affected Products and Solutions
This security advisory provides information on the following products:
| PRODUCT NAME | VERSION(S) AFFECTED | SOLUTION(S) AVAILABLE |
| OpenScape Endpoint Management | V1 R2.4.0 and earlier | Upgrade to OpenScape Endpoint Management V1R2.5.1 or later. |
Product statements are related only to supported product versions. Products that have reached End of Support status are not considered.
Vulnerability Severity
The following products have been identified as affected:
| PRODUCT NAME | CVE ID | SEVERITY | CVSS 3.1 BASE SCORE |
| OpenScape Endpoint Management | MTLVULN-1788 | High / 8.8 | AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| OpenScape Endpoint Management | MTLVULN-1789 | High / 7.2 | AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
The vulnerability severities are rated as high.
Note: The above issue is referenced here by our internal tracking ID. A CVE identifier has been requested but is not yet assigned.
Solution/ Recommended Action
These issues are corrected in OpenScape Endpoint Management V1R2.5.1. Customers are advised to upgrade to this or subsequent releases.
Please see Mitel Security Knowledge Base Article KB000128955, “OpenScape Endpoint Management Security Update, MTLVULN-1788, MTLVULN-1789”
If you do not have access to the Mitel Security Knowledge Base article, please contact your Mitel Authorized Partner for support.
For further information, please contact Mitel Product Support.
Revision History
| Version | Date | Description |
|---|---|---|
| 1.0 | 2026-10-28 | Initial release |
Publisher and Legal Disclaimer
Publisher: Mitel PSIRT / [email protected]
The information provided in this advisory is provided "as is" without warranty of any kind. The information is subject to change without notice. Mitel and its affiliates do not guarantee and accept no legal liability whatsoever arising from or connected to the accuracy, reliability, currency or completeness of the information provided. No part of this document can be reproduced or transmitted in any form or by any means - electronic or mechanical - for any purpose without written permission from Mitel Networks Corporation.