Mitel MiVoice Office 400 CVE-2026-104706

Exploitation requires an authenticated session with high/administrative privileges on the MiVoice Office 400 management portal (https://<ip>:8443), specifically access to the Administration -> View Logs function, which is the exact feature carrying the path-traversal flaw (PR:H confirms privileged access is needed). No end-user interaction is required (UI:N). The published vector marks the attack vector as local (AV:L), but the vulnerable function is served over a network-facing HTTPS portal on port 8443, so realistic reachability likely depends on whether that admin portal is exposed to the attacker's network segment - verify the AV classification with the vendor. The primary limiting factor is the administrator-level authentication requirement, which confines exploitation to insiders or attackers who have already compromised admin credentials/sessions.

This is a genuine but access-gated risk rather than a drop-everything emergency. The vendor/NCSC.ch CVSS 4.0 vector (score 8.4, High) rates confidentiality, integrity and availability all High across both vulnerable and subsequent systems, which is aggressive for a flaw the description characterizes as read-only ('view or download sensitive system files') - a straight path-traversal file-disclosure would normally drive confidentiality only, so the I/A and subsequent-system High ratings appear to assume downstream compromise (e.g., harvested credentials or config enabling further attack) rather than direct integrity/availability loss. The strongest mitigating signal is PR:H: exploitation requires high-privilege access to the Administration -> View Logs menu, meaning an attacker must already be an authenticated administrator (or have hijacked an admin session), which sharply limits the realistic attacker population and makes this closer to a privilege-boundary/defense-in-depth failure than a pre-auth breach. CONFLICTING SIGNAL: the vector specifies AV:L (local) yet the vulnerability is explicitly reached over a network portal at https://<ip>:8443 - a remotely reachable web interface would typically warrant AV:N; this AV:L choice should be verified with the vendor, as it materially lowers the published score versus a network-reachable reality. Exploit maturity E:P indicates a proof-of-concept exists and AU:Y marks it automatable, but there is no CISA KEV listing and no EPSS value supplied, so there is no evidence of active or widespread exploitation. Net: a real priority to patch for Mitel MiVoice Office 400 operators, but the admin-authentication prerequisite keeps real-world mass-exploitation risk moderate, not critical.

An authenticated administrator (or an attacker who has obtained admin credentials or a valid admin session) logs into the MiVoice Office 400 management portal at https://<ip>:8443, navigates to Administration -> View Logs, and supplies a crafted file path containing directory-traversal sequences to read or download arbitrary sensitive system files outside the intended log directory. A proof-of-concept is indicated by the CVSS exploit-maturity flag (E:P), and the vector marks the attack as automatable (AU:Y), so a scripted tool could iterate over sensitive paths to harvest configuration, credential, or system files.