MiVoice Office 400 EUVD-2026-92298

Exploitation requires an authenticated account with high privileges to reach Configuration → Users → Users List in the Mitel MiVoice Office 400 web portal (HTTPS on TCP 443) and edit the 'Microsoft Exchange mailbox' field, which fails to sanitize stored input. The payload is stored and only triggers when another user (e.g., an administrator) subsequently opens the affected user's properties, so exploitation depends on that passive victim interaction (UI:P). Limiting factors: high privilege level required (PR:H), required victim viewing of the record, and applicability only to the Mitel MiVoice Office 400 web portal - this is not remotely triggerable against an unauthenticated or default-facing surface.

This is a low-priority issue despite being a stored XSS, and the signals are mostly consistent on that point. The CVSS 4.0 base score is only 1.9, driven by PR:H (attacker must already hold high privileges to reach Configuration → Users → Users List), UI:P (a victim must passively view the affected user properties), and limited impact (VC:L/VI:L/VA:N, with subsequent-system SC:L/SI:L). Exploit maturity E:P indicates a proof-of-concept exists, so 'publicly available exploit code exists' - but there is NO CISA KEV listing, so this is not confirmed active exploitation, and the two signals must not be conflated. EPSS is NOT provided in the input, so real-world exploitation probability cannot be quantified. Notably, the description characterizes the outcome as a denial-of-service of the user-management view, yet the vendor-supplied vector sets VA:N (no availability impact) and instead assigns VC:L/VI:L - a minor internal inconsistency worth noting: the DoS claim in prose is not reflected in the availability metric. Overall, the combination of required high privileges, required user interaction, limited blast radius, and absence of KEV/EPSS evidence makes this a genuinely low real-world risk rather than an urgent priority.

An authenticated operator with access to the user-configuration portal (TCP 443) injects a persistent JavaScript/HTML payload into the 'Microsoft Exchange mailbox' field of a user record. When an administrator later opens that user's properties, the stored script executes in their browser and disrupts the user-management interface, blocking access to the affected user's properties. A proof-of-concept is indicated by the CVSS exploit-maturity value E:P.