Mitel Mivoice Office 400
Monthly
Remote code execution in Mitel MiVoice Office 400 is possible when an authenticated high-privilege user uploads a malicious shared object through the Music on Hold configuration page instead of a valid WAV file, because the application fails to validate file type before loading it. This is a CWE-434 unrestricted file upload issue affecting the web portal on TCP 443; the independent assessment maps it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. No public exploit code or confirmed KEV exploitation was identified in the provided intelligence, and exploitation is constrained by the need for administrative credentials to reach the vulnerable upload feature.
Authenticated high-privilege attackers with access to the Mitel MiVoice Office 400 web portal on TCP 443 can exploit a directory traversal in Maintenance → File Management → File Browser to delete files outside the intended directory, including application and Linux system files, causing denial of service. The flaw affects MiVoice Office 400 deployments exposing the portal, requires a valid administrative/maintenance account, and has no public exploit identified at time of analysis. The independent assessment rates it as a moderate-priority, authentication-gated destructive issue rather than a mass-exploitation threat.
Arbitrary code execution and full compromise of the underlying Mitel Linux virtual machine in Mitel MiVoice Office 400 occur when a high-privileged local attacker plants a shared object (.so) whose name matches a predictable module that a privileged process loads without verifying its origin or integrity (CWE-73), causing the attacker's code to run with that process's privileges. The assessed attack vector is local with high privileges required (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so this is a post-compromise escalation or persistence technique rather than a remotely wormable flaw. A proof-of-concept exploit is assessed (CVSS 4.0 E:P); no CISA KEV entry confirms active exploitation at time of analysis.
Arbitrary file write in Mitel MiVoice Office 400 backup restoration can lead to root-level code execution if an attacker can supply a malicious TGZ archive to the configured backup repository; however, exploitation requires privileged access to the backup repository and a restore operation, making it a high-severity issue but not an indiscriminate internet-facing threat. No public exploit identified at time of analysis.
Path traversal in the Mitel MiVoice Office 400 web administration portal (https://<ip>:8443, reached through Administration -> View Logs) lets an authenticated administrator view or download sensitive system files that the portal's service context can read. Exploitation requires a high-privileged admin session and no user interaction, so the practical risk is access-gated: insiders, or attackers who have already stolen admin credentials or hijacked an admin session, are the realistic threat actors. The CNA rates it CVSS 4.0 8.4 with PR:H and a proof-of-concept-level exploit maturity metric (E:P), while our independent CVSS 3.1 assessment (7.2, AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N) characterizes it as a genuine but access-gated risk; no confirmed active exploitation (CISA KEV) or evidence of widespread attack activity appears in the available intelligence.
Stored cross-site scripting in the 'Microsoft Exchange mailbox' field of the Mitel MiVoice Office 400 web portal lets a high-privileged authenticated user persist JavaScript that executes when another administrator opens the affected user's properties, disrupting access to user-management functions rather than enabling broad system compromise. The issue is rated low severity (CVSS 1.9; assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), and there is no indication of confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis. Exploitation requires access to Configuration → Users → Users List over HTTPS on TCP 443 and a subsequent victim viewing the record, so it is not remotely triggerable against unauthenticated or default-facing surfaces.
Authenticated users with high privileges can inject persistent JavaScript into the MiVoice Office 400 web portal's Configuration → Domains 'Description' field, leading to stored XSS that executes in the browser of any other administrator viewing the page. This can alter page content, facilitate phishing within the trusted application context, and potentially steal session data, though the impact is confined to the browser context with no OS-level compromise or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the issue carries a low severity rating (CVSS 3.1 ~3.9; CVSS 4.0 1.9).
Authenticated path traversal in the Mitel MiVoice Office 400 web management portal (TCP 443) lets a high-privilege maintenance or administrator user read files outside the intended system logs directory by supplying crafted path input to the Maintenance → System Logs download function. Only users who already hold valid high-privilege portal credentials can trigger it (CVSS vector PR:H), and the impact is limited to confidentiality - files can be read or downloaded, but there is no write, code-execution, or denial-of-service capability. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed risk is moderate rather than critical because exploitation is gated behind authenticated administrative access to an interface that should normally be restricted to trusted networks.
Remote code execution in Mitel MiVoice Office 400 is possible when an authenticated high-privilege user uploads a malicious shared object through the Music on Hold configuration page instead of a valid WAV file, because the application fails to validate file type before loading it. This is a CWE-434 unrestricted file upload issue affecting the web portal on TCP 443; the independent assessment maps it as CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. No public exploit code or confirmed KEV exploitation was identified in the provided intelligence, and exploitation is constrained by the need for administrative credentials to reach the vulnerable upload feature.
Authenticated high-privilege attackers with access to the Mitel MiVoice Office 400 web portal on TCP 443 can exploit a directory traversal in Maintenance → File Management → File Browser to delete files outside the intended directory, including application and Linux system files, causing denial of service. The flaw affects MiVoice Office 400 deployments exposing the portal, requires a valid administrative/maintenance account, and has no public exploit identified at time of analysis. The independent assessment rates it as a moderate-priority, authentication-gated destructive issue rather than a mass-exploitation threat.
Arbitrary code execution and full compromise of the underlying Mitel Linux virtual machine in Mitel MiVoice Office 400 occur when a high-privileged local attacker plants a shared object (.so) whose name matches a predictable module that a privileged process loads without verifying its origin or integrity (CWE-73), causing the attacker's code to run with that process's privileges. The assessed attack vector is local with high privileges required (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H), so this is a post-compromise escalation or persistence technique rather than a remotely wormable flaw. A proof-of-concept exploit is assessed (CVSS 4.0 E:P); no CISA KEV entry confirms active exploitation at time of analysis.
Arbitrary file write in Mitel MiVoice Office 400 backup restoration can lead to root-level code execution if an attacker can supply a malicious TGZ archive to the configured backup repository; however, exploitation requires privileged access to the backup repository and a restore operation, making it a high-severity issue but not an indiscriminate internet-facing threat. No public exploit identified at time of analysis.
Path traversal in the Mitel MiVoice Office 400 web administration portal (https://<ip>:8443, reached through Administration -> View Logs) lets an authenticated administrator view or download sensitive system files that the portal's service context can read. Exploitation requires a high-privileged admin session and no user interaction, so the practical risk is access-gated: insiders, or attackers who have already stolen admin credentials or hijacked an admin session, are the realistic threat actors. The CNA rates it CVSS 4.0 8.4 with PR:H and a proof-of-concept-level exploit maturity metric (E:P), while our independent CVSS 3.1 assessment (7.2, AV:N/AC:L/PR:H/UI:N/C:H/I:N/A:N) characterizes it as a genuine but access-gated risk; no confirmed active exploitation (CISA KEV) or evidence of widespread attack activity appears in the available intelligence.
Stored cross-site scripting in the 'Microsoft Exchange mailbox' field of the Mitel MiVoice Office 400 web portal lets a high-privileged authenticated user persist JavaScript that executes when another administrator opens the affected user's properties, disrupting access to user-management functions rather than enabling broad system compromise. The issue is rated low severity (CVSS 1.9; assessed CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N), and there is no indication of confirmed active exploitation (CISA KEV) and no public exploit identified at time of analysis. Exploitation requires access to Configuration → Users → Users List over HTTPS on TCP 443 and a subsequent victim viewing the record, so it is not remotely triggerable against unauthenticated or default-facing surfaces.
Authenticated users with high privileges can inject persistent JavaScript into the MiVoice Office 400 web portal's Configuration → Domains 'Description' field, leading to stored XSS that executes in the browser of any other administrator viewing the page. This can alter page content, facilitate phishing within the trusted application context, and potentially steal session data, though the impact is confined to the browser context with no OS-level compromise or availability impact. No public exploit code or active exploitation has been identified at time of analysis, and the issue carries a low severity rating (CVSS 3.1 ~3.9; CVSS 4.0 1.9).
Authenticated path traversal in the Mitel MiVoice Office 400 web management portal (TCP 443) lets a high-privilege maintenance or administrator user read files outside the intended system logs directory by supplying crafted path input to the Maintenance → System Logs download function. Only users who already hold valid high-privilege portal credentials can trigger it (CVSS vector PR:H), and the impact is limited to confidentiality - files can be read or downloaded, but there is no write, code-execution, or denial-of-service capability. No public exploit code and no confirmed active exploitation were identified at time of analysis, and the assessed risk is moderate rather than critical because exploitation is gated behind authenticated administrative access to an interface that should normally be restricted to trusted networks.