Critical Vulnerabilities in Mitel SIP Phones Let Attackers Inject Malicious Commands

Security researchers have discovered two significant vulnerabilities affecting Mitel’s suite of SIP phones that could allow attackers to execute arbitrary commands and upload malicious files. The more severe vulnerability, identified as CVE-2025-47188, received a critical CVSS score of 9.8 and affects the company’s 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit. The affected products include all versions of the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit running firmware version R6.4.0.SP4 and earlier. This command injection vulnerability stems from insufficient parameter sanitization that could potentially expose sensitive system and user configuration data while affecting device availability and operations. The researchers noted that while this somewhat limits the attack surface, many organizations deploy these devices on internal networks that may already be compromised through other means, creating a significant security risk for enterprise communications infrastructure. This secondary vulnerability enables attackers to upload arbitrary WAV files to affected devices, potentially exhausting the phone’s storage capacity. The command injection vulnerability exists in the phone’s web interface processing components, where certain parameters are not properly sanitized before being passed to system commands. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. For organizations unable to update immediately, Mitel recommends implementing network segmentation to restrict access to these devices and reviewing additional mitigation strategies detailed in knowledge base article SO8496. The vulnerabilities were brought to Mitel’s attention by Marc Bollhalder of InfoGuard Labs, highlighting the importance of coordinated vulnerability disclosure in telecommunications security. Mitel analysts identified that successful exploitation of these vulnerabilities requires network access to the targeted phones. Organizations using affected Mitel SIP phones are strongly encouraged to update to this version or later to mitigate the risk. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news. When successfully leveraged, attackers gain the ability to execute arbitrary commands within the context of the phone’s system. This could lead to complete compromise of the device, allowing attackers to access sensitive data, modify configurations, or even render the device inoperable. When exploited, an attacker can append malicious commands using command separators (like semicolons or pipes) that are then executed with the privileges of the web server process.

This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 12 May 2025 06:30:00 +0000


Cyber News related to Critical Vulnerabilities in Mitel SIP Phones Let Attackers Inject Malicious Commands

Critical Vulnerabilities in Mitel SIP Phones Let Attackers Inject Malicious Commands - Security researchers have discovered two significant vulnerabilities affecting Mitel’s suite of SIP phones that could allow attackers to execute arbitrary commands and upload malicious files. The more severe vulnerability, identified as ...
1 month ago Cybersecuritynews.com CVE-2025-47188
CVE-2022-22204 - An Improper Release of Memory Before Removing Last Reference vulnerability in the Session Initiation Protocol (SIP) Application Layer Gateway (ALG) of Juniper Networks Junos OS allows unauthenticated network-based attacker to cause a partial Denial ...
2 years ago
9 Best DDoS Protection Service Providers for 2024 - eSecurity Planet content and product recommendations are editorially independent. We may make money when you click on links to our partners. Learn More. One of the most powerful defenses an organization can employ against distributed ...
1 year ago Esecurityplanet.com
CVE-2023-22408 - An Improper Validation of Array Index vulnerability in the SIP ALG of Juniper Networks Junos OS on SRX 5000 Series allows a network-based, unauthenticated attacker to cause a Denial of Service (DoS). When an attacker sends an SIP packets with a ...
2 years ago
CVE-2023-22394 - An Improper Handling of Unexpected Data Type vulnerability in the handling of SIP calls in Juniper Networks Junos OS on SRX Series and MX Series platforms allows an attacker to cause a memory leak leading to Denial of Services (DoS). This issue ...
2 years ago
Strobes 2023 Pentesting Recap: Trends, Stats, and How PTaaS is Transforming Cybersecurity - This article covers some amazing statistics on what category of vulnerabilities we commonly report across 100s of customers, and how we reduce compliance times and turn around time to reporting critical vulnerabilities. In a different article, we ...
1 year ago Securityboulevard.com
Samsung Galaxy App Store Vulnerabilities: Exploits Released and What These Mean For Users - Exploits have recently been released for two Samsung Galaxy App Store vulnerabilities, representing a major security risk for users of the smartphone. The first vulnerability is in the Galaxy App Store where malicious app developers can bypass ...
2 years ago Bleepingcomputer.com
CVE-2019-1683 - A vulnerability in the certificate handling component of the Cisco SPA112, SPA525, and SPA5X5 Series IP Phones could allow an unauthenticated, remote attacker to listen to or control some aspects of a Transport Level Security (TLS)-encrypted Session ...
2 years ago
CVE-2018-0325 - A vulnerability in the Session Initiation Protocol (SIP) call-handling functionality of Cisco IP Phone 7800 Series phones and Cisco IP Phone 8800 Series phones could allow an unauthenticated, remote attacker to cause a denial of service (DoS) ...
5 years ago
CVE-2021-37624 - FreeSWITCH is a Software Defined Telecom Stack enabling the digital transformation from proprietary telecom switches to a software implementation that runs on any commodity hardware. Prior to version 1.10.7, FreeSWITCH does not authenticate SIP ...
2 years ago
CVE-2022-29855 - Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) ...
1 year ago
CVE-2017-12328 - A vulnerability in Session Initiation Protocol (SIP) call handling in Cisco IP Phone 8800 Series devices could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the SIP process unexpectedly restarts. All ...
5 years ago
Misconfiguration and vulnerabilities biggest risks in cloud security: Report - The two biggest cloud security risks continue to be misconfigurations and vulnerabilities, which are being introduced in greater numbers through software supply chains, according to a report by Sysdig. While zero trust is a top priority, data showed ...
2 years ago Csoonline.com Hunters
CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
1 year ago Securityaffairs.com
Cybersecurity Weekly Recap: Latest on Attacks, Vulnerabilities, & Data Breaches - A critical SSRF vulnerability in Microsoft Power Platform’s SharePoint connector allowed attackers to impersonate users and access sensitive data. Ivanti patched a critical command injection vulnerability in its Cloud Services Appliance (CSA), ...
4 months ago Cybersecuritynews.com CVE-2025-0108 CVE-2024-53704 CVE-2024-52875 CVE-2023-20198 CVE-2023-20273 Winnti Group
New GPAUF Technique to Root Qualcomm-Based Android Phones - Qualcomm has issued patches for the vulnerabilities, but security experts recommend users update their devices immediately as attackers could potentially exploit these flaws to gain complete control of affected devices, access sensitive data, and ...
1 month ago Cybersecuritynews.com CVE-2024-23380
Why CVEs Are an Incentives Problem - I've been thinking about some of these unintended consequences in the context of a growing problem faced by all of us in cybersecurity: how a fast-rising tide of software vulnerabilities tracked as common vulnerabilities and exposures - are reported ...
1 year ago Darkreading.com
CVE-2017-9861 - An issue was discovered in SMA Solar Technology products. The SIP implementation does not properly use authentication with encryption: it is vulnerable to replay attacks, packet injection attacks, and man in the middle attacks. An attacker is able to ...
11 months ago
CVE-2023-32307 - Sofia-SIP is an open-source SIP User-Agent library, compliant with the IETF RFC3261 specification. ...
1 year ago
CVE-2017-12260 - A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA50x, SPA51x, and SPA52x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become ...
5 years ago
CVE-2017-12259 - A vulnerability in the implementation of Session Initiation Protocol (SIP) functionality in Cisco Small Business SPA51x Series IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in ...
5 years ago
CVE-2018-0389 - A vulnerability in the implementation of Session Initiation Protocol (SIP) processing in Cisco Small Business SPA514G IP Phones could allow an unauthenticated, remote attacker to cause an affected device to become unresponsive, resulting in a denial ...
5 years ago
Creating a formula for effective vulnerability prioritization - In this Help Net Security interview, Michael Gorelik, CTO and Head of Malware Research at Morphisec, provides insights into the business impact of vulnerabilities. Gorelik discusses challenges posed by regulatory frameworks, incomplete asset ...
1 year ago Helpnetsecurity.com
Microsoft Patch Tuesday 2024: 49 Vulnerabilities are fixed - Microsoft released its first patch on Tuesday, 2024, in which nearly 49 vulnerabilities have been fixed in Microsoft products and 5 vulnerabilities in non-Microsoft products. Among these 49 vulnerabilities, there were 12 remote code execution ...
1 year ago Cybersecuritynews.com CVE-2024-20674 CVE-2024-20700 CVE-2024-0057
CVE-2025-20165 - A vulnerability in the SIP processing subsystem of Cisco BroadWorks could allow an unauthenticated, remote attacker to halt the processing of incoming SIP requests, resulting in a denial of service (DoS) condition. This vulnerability is due to ...
4 months ago Tenable.com