What is the CVSS score of CVE-2024-41710?

CVE-2024-41710 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 41.6%.

Is there a public PoC exploit available for CVE-2024-41710?

Yes, a public proof-of-concept exploit is available for CVE-2024-41710. Prioritise patching immediately. EPSS: 41.6%.

6970 Firmware CVE-2024-41710

HIGH

Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') (CWE-88)

2024-08-12 cve@mitre.org

Code Injection 6970 Firmware 6940W Sip Firmware 6930W Sip Firmware 6920W Sip Firmware 6920 Sip Firmware 6915 Sip Firmware 6910 Sip Firmware 6905 Sip Firmware 6940 Sip Firmware 6930 Sip Firmware 6873I Sip Firmware 6869I Sip Firmware 6867I Sip Firmware 6865I Sip Firmware 6863I Sip Firmware

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Added to CISA KEV

Jul 14, 2026 - 04:22 CISA

CVE Published

Aug 12, 2024 - 19:15 nvd

HIGH 7.2

DescriptionNVD

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

AnalysisAI

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified under CWE-88. A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system. Affected products include: Mitel 6970 Firmware, Mitel 6940W Sip Firmware, Mitel 6930W Sip Firmware, Mitel 6920W Sip Firmware, Mitel 6920 Sip Firmware.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Apply vendor patches when available. Implement network segmentation and monitoring as interim mitigations.