MiVoice Office 400 CVE-2026-104809

Exploitation requires the attacker to first have local, privileged access (CVSS PR:H, AV:L) sufficient to write a malicious shared object (.so) into the filesystem location that the privileged Mitel process searches, using the exact predictable module name the loader expects. The core defect is that the loader resolves this module by a predictable name without validating the file's origin or integrity. Limiting factors: no remote network vector (local access only), and the attacker must already hold high privileges / write access to the module path - so this is not exploitable by an unauthenticated or purely remote attacker against a default configuration; it functions as a post-compromise code-execution/persistence step. No user interaction is required (UI:N).

This is a locally-exploitable code-execution flaw (CWE-73, External Control of File Name or Path) rather than a remotely-wormable one. The provided CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:H/UI:N) is internally consistent with the description: exploitation is local, low-complexity, requires high privileges, and needs no user interaction, while impact is total (VC:H/VI:H/VA:H plus subsequent-system SC:H/SI:H/SA:H reflecting full compromise of the Mitel Linux VM). The exploit-maturity metric E:P indicates proof-of-concept exploit code exists, but there is NO CISA KEV listing and NO EPSS score in the input, so there is no evidence of active or widespread exploitation - the POC signal and the absence of KEV together suggest this is a viable but not mass-exploited issue. The practical risk is gated hard by PR:H and AV:L: an attacker already needs local, privileged access (enough to write the malicious .so into the predictable load path) before this becomes useful, which makes it primarily a privilege-consolidation / persistence primitive for an already-present attacker rather than an initial-access vulnerability. One cross-source discrepancy to verify with the vendor: the CPE identifies 'mitel_mivoice_office_400' while the description refers to a 'Mitel Linux virtual machine' - confirm the exact affected product/platform with Mitel before scoping. Net: a genuine high-severity local RCE worth patching on exposed Mitel systems, but not an emergency internet-facing threat absent further exposure data.

An attacker who has already gained a foothold with sufficient privileges on the Mitel Linux VM plants a malicious shared object using the expected, predictable module name in the location the privileged process searches. When that privileged process loads the module without verifying its origin or integrity, the attacker's code executes in the process's context, yielding arbitrary code execution and full compromise. Proof-of-concept exploit code exists (CVSS E:P), though no active exploitation is reported.