MiVoice Office 400 CVE-2026-104805

Exploitation requires the attacker to already have write access to the configured backup repository (SFTP or other configured target) and the system to subsequently perform a restore of the attacker-supplied TGZ archive. The specific enabling weakness is that the restore mechanism performs no path validation, file-type checking, integrity checking, or file-signature verification before extraction, allowing traversal entries to escape the intended directory. The absence of an enforced backup password lowers the barrier to obtaining repository access. Limiting factors: this is NOT remote-unauthenticated against a default config - it requires privileged access to the backup repository (reflected as PR:H) and a restore operation to be triggered, which constrains exploitation to insiders or attackers who have already compromised the backup storage path.

This is a genuine high-severity issue but not an indiscriminate internet-facing threat. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N) with full vulnerable- and subsequent-system impact (VC/VI/VA:H, SC/SI/SA:H) and score 8.5 reflects a path-traversal flaw (CWE-22) in the backup restore routine that can yield root-level compromise of the underlying VM. The critical tempering signal is PR:H: exploitation requires privileged access to the configured backup repository (SFTP or equivalent), so this is an authenticated/privileged-access attack, not remote-unauthenticated. CVSS exploit maturity is E:P (Proof-of-Concept), indicating a PoC-level technique rather than confirmed mass exploitation. No EPSS score was provided, so exploitation probability cannot be quantified. No CISA KEV listing is present, so there is no evidence of active in-the-wild exploitation. Net: prioritize patching for Mitel MiVoice Office 400 operators because the impact is full root RCE, but the required privileged repository access substantially narrows the realistic attacker population, making this a targeted/insider-leaning risk rather than a wormable mass-exploitation threat.

An attacker who has obtained access to the configured backup repository (e.g., the SFTP target), aided by the absence of an enforced backup password, places a specially crafted TGZ archive containing path-traversal entries and attacker-controlled files. When the MiVoice Office 400 system restores this backup, it extracts the files without validating paths, file types, or signatures, writing attacker files to sensitive OS locations and potentially achieving arbitrary code execution as root. CVSS exploit maturity E:P indicates a proof-of-concept technique exists; attack complexity is low once repository access is held.