MiVoice Office 400 EUVD-2026-92305

Requires authenticated, high-privilege access to the Configuration → Services → Music on Hold upload function of the Mitel MiVoice Office 400 web portal on TCP port 443; the attacker uploads a malicious shared object (.so) in place of a WAV file, which the application loads and executes due to missing file-type validation. Exploitation is limited by the need for privileged (administrative) credentials to reach the configuration upload feature (PR:H per the CVSS vector and the description's 'Authentication may be required'); it is not exploitable by an unauthenticated user against a default configuration.

This is a CWE-434 unrestricted file upload leading to RCE in Mitel MiVoice Office 400, reported by NCSC.ch. A significant signal conflict must be flagged: the input CVSS 4.0 vector declares AV:L (local) with SC:H/SI:H/SA:H, yet the description states the vulnerable feature is a web portal listening on TCP port 443 and refers to 'remote attackers' - a web service reachable over the network is normally AV:N, so the input's AV:L appears mislabeled; verify the true attack surface with the vendor. The one strongly reliable constraint is PR:H - the input vector and the description ('Authentication may be required') agree that exploitation targets a privileged configuration area (Configuration → Services → Music on Hold), so this is not an unauthenticated drive-by. No EPSS score, no CISA KEV listing, and no public POC are present in the provided data, so exploitation status is 'no public exploit identified at time of analysis.' Net assessment: technically high-impact (full Linux host compromise, all C/I/A high) but gated behind administrative/high-privilege authentication, which materially lowers real-world urgency compared to an unauthenticated RCE. Treat as a priority patch for internet-exposed or multi-admin deployments, but the privilege barrier makes mass/automated exploitation unlikely absent a chained auth-bypass.

An attacker who already holds privileged web-portal credentials (or has chained a separate auth flaw) navigates to Configuration → Services → Music on Hold and uploads a malicious shared object (.so) in place of the expected WAV file. Because the application fails to validate the real file type, the component later loads the .so and executes attacker-controlled code as the service process, yielding remote code execution and potential full compromise of the underlying Linux system. No public exploit code is identified at this time.