MiVoice Office 400 EUVD-2026-92296

Exploitation requires an authenticated account with sufficient privilege to edit the Configuration → Domains 'Description' field on the Mitel MiVoice Office 400 web portal (TCP/443) - consistent with PR:H. The payload is stored but only triggers when a second user (e.g., another administrator/operator) subsequently views the affected page, matching the UI:P passive-interaction requirement. Limiting factors: this is not remote-unauthenticated (a privileged session is a prerequisite), impact is confined to the browser context of victim users rather than the appliance OS, and there is no availability impact. These constraints substantially reduce realistic risk below what the 'network vector' label alone might imply.

This is a genuinely low-priority issue despite being network-reachable. The CVSS 4.0 base score is 1.9 (Low), and the vector tells a consistent story: although AV:N/AC:L make the flaw remotely reachable over the port-443 web portal, exploitation requires PR:H (high privileges - an authenticated administrative/operator account able to edit Configuration → Domains) and UI:P (a second victim user must passively view the affected page). Impact is bounded to Low across confidentiality and integrity (VC:L/VI:L), with no availability impact (VA:N), and the subsequent-system impacts (SC:L/SI:L) reflect that injected script runs in another user's trusted browser session rather than compromising the host. The E:P (Proof-of-Concept) exploit-maturity flag indicates PoC-level code rather than mature/weaponized tooling, and the vulnerability is NOT in CISA KEV. No EPSS score was provided in the input, so widespread-exploitation probability cannot be quantified from the data. There are no conflicting signals here - a high-privileged attacker who can already edit domain configuration gaining the ability to inject stored script into other operators' sessions is a real but modest privilege/trust-boundary issue, not an urgent remote-takeover risk.

An authenticated user with configuration privileges navigates to Configuration → Domains and enters a malicious JavaScript/HTML payload into the 'Description' field, which the application stores without sanitization. When another administrator or operator later views that domain page in the trusted port-443 portal, the script executes in their browser session, enabling defacement, attacker-controlled content, or an in-context phishing lure. Proof-of-concept exploit maturity (CVSS E:P) is indicated, but no weaponized or in-the-wild exploitation is confirmed.