Mivoice Connect vulnerabilities

8 known vulnerabilities in Mivoice Connect from Mitel. 6 are rated high or critical, and 3 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.5 High severity

  Mivoice Connect: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2023-39289Aug 25, 2023Mitel

  A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker

• 9.8 Critical severity

  Mivoice Connect: Incorrect Authorization

  CVE-2023-32748Aug 14, 2023Mitel

  The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.

• 7.4 High severity

  Mivoice Connect: Improper Neutralization of Input During Web Page Generation

  CVE-2023-25599May 24, 2023Mitel

  A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the test_presenter.php pag

• 7.2 High severity

  Mivoice Connect: Improper Neutralization of Special Elements used in a Command

  CVE-2023-31460May 24, 2023MitelEPSS 1.65%

  A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with internal network access to conduct a command injection attack due to insufficient restriction on URL parame

• 8.8 High severity

  Mivoice Connect: Weak Password Recovery Mechanism for Forgotten Password

  CVE-2023-31459May 24, 2023Mitel

  A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial install

• 6.8 Medium severity

  Mitel MiVoice Connect Code Injection Exploited

  CVE-2022-41223Nov 22, 2022MitelEPSS 10.7%

  The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

• 6.8 Medium severity

  Mitel MiVoice Connect Command Injection Exploited

  CVE-2022-40765Nov 22, 2022MitelEPSS 10.6%

  A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters.

• 9.8 Critical severity

  Mitel MiVoice Connect Data Validation Exploited

  CVE-2022-29499Apr 26, 2022MitelEPSS 55.2%

  The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.