MiVoice Office 400 EUVD-2026-92303

Exploitation requires an authenticated, high-privilege account able to reach the Maintenance → File Management → File Browser function of the MiVoice Office 400 web portal on TCP port 443 (PR:H). The limiting factors are significant: the attacker must already hold administrative/maintenance credentials, and the portal must be reachable. No end-user interaction is needed (UI:N) and no special non-default feature toggle is described - the File Browser is a standard maintenance feature. The documented impact is deletion of files outside the intended directory (Mitel application and underlying Linux system files), producing a denial-of-service condition; data read/disclosure is not clearly established.

This is a moderate-priority, authentication-gated destructive flaw rather than a mass-exploitation threat. The CVSS 4.0 base score of 8.4 is driven by high vulnerable- and subsequent-system impact (VI:H/VA:H/SI:H/SA:H), reflecting that file deletion can cascade from the Mitel application into the underlying Linux OS. However, PR:H means exploitation requires high-privilege (administrative/maintenance) authentication, which sharply narrows the realistic attacker population. Key signal conflict: the vendor vector specifies AV:L (local), yet the description places the flaw in a web portal listening on TCP 443 under Maintenance → File Management, which implies network reachability (AV:N) - this discrepancy should be verified with the vendor/CNA. The CVSS threat metrics show E:P (proof-of-concept exploit maturity) and AU:Y (automatable), which modestly raise concern, but there is no CISA KEV listing and no standalone public exploit reference, so there is no evidence of active or widespread exploitation. Impact is destructive (deletion → DoS) rather than data-stealing; confidentiality impact is uncertain since the description emphasizes deletion, not disclosure. Net: a genuine integrity/availability risk for exposed, admin-reachable MiVoice Office 400 systems, but the admin-auth prerequisite makes it a managed patch priority rather than an emergency.

An attacker who already holds administrative/maintenance credentials to the MiVoice Office 400 web portal (TCP 443) navigates to Maintenance → File Management → File Browser and submits a path containing directory-traversal sequences. By targeting files outside the intended directory, they delete critical Mitel application or Linux system files, rendering the PBX inoperable (denial of service). The CVSS threat metric indicates proof-of-concept exploit maturity (E:P), and the technique is flagged automatable (AU:Y), though no public exploit code is referenced.