MiVoice Office 400 CVE-2026-104806

Requires authenticated, high-privilege (maintenance/administrator) access to the Mitel MiVoice Office 400 web management portal reachable over HTTPS on TCP port 443; the attacker then supplies crafted directory-traversal input to the file-path parameter of the Maintenance → System Logs download function, which fails to validate user-supplied paths. LIMITING FACTORS: exploitation is gated by PR:H (valid high-privilege portal credentials are mandatory - this is not pre-auth), impact is confined to reading/downloading files (no write or service-disruption capability), and network reachability of the management interface is assumed; restricting management-portal exposure to trusted networks further constrains realistic abuse.

This is a moderate, not critical, priority. The CVSS 4.0 base score is 5.5 (Medium), and the vector tells a consistent story: AV:N (network-reachable over the HTTPS management portal on TCP 443), AC:L (no special conditions to win a race or bypass a mitigation), but crucially PR:H - the attacker must already hold high-privilege (maintenance/administrator) credentials to the web management portal. Impact is confidentiality-only (VC:H, VI:N, VA:N): an attacker can read/exfiltrate files but cannot modify the system or take it down. The CVSS 4.0 threat metric E:P indicates a Proof-of-Concept exploit maturity, so publicly available exploit code likely exists; however this is POC maturity, not confirmed active exploitation. There is NO CISA KEV listing and NO EPSS score provided in the input, so widespread opportunistic exploitation cannot be asserted. The PR:H requirement is the dominant mitigating factor - it reduces this from a wormable pre-auth data-leak to a post-authentication privilege-to-file-access escalation, most realistically useful to an attacker who has already compromised admin credentials or to a malicious/low-trust insider abusing legitimate maintenance access. MISSING DATA: no EPSS, no independent POC confirmation beyond the CVSS E:P flag, and no vendor advisory URL (the only reference is a researcher landing page), so patch availability and fixed versions are unverified.

An attacker who already possesses high-privilege credentials to the Mitel MiVoice Office 400 web management portal (TCP 443) navigates to Maintenance → System Logs and manipulates the file-path parameter with directory-traversal sequences (e.g. ..\..\) to step outside the logs directory. The server returns files it should not, letting the attacker download sensitive system and application files such as configuration or credential material. The CVSS E:P threat flag indicates proof-of-concept exploit code exists, and the low attack complexity (AC:L) means the traversal requires no special timing or conditions once authenticated.