CVE-2024-41710

highpriority · act · 90OT risk · criticalKEV · exploitedEPSS 0.416 · 99 %ileDEEURUUS

grimoire priorityP0 · Act now

Exploitable?

Yes · in the wild

CISA KEV

Likely / severe?

41.6% (99th) EPSS

CVSS 7.2 · high

Is it mine?

22 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

added 2025-02-12remediate by 2025-03-05

required action Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS · scored 2026-10-26

Mitel SIP Phones Argument Injection Vulnerability

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

cvss

Technical severity, 0–10. One row per scoring source.

7.2

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 6.8–7.2

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 1.2 · impact 5.9

v3.16.8mediumAV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.16.8mediumCVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:Hsecondaryexploitability 0.9 · impact 5.9

v3.17.2highCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:Hsecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: active · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-88USprimaryCWE-88US

ATT&CK techniques

ATT&CK techniques this enables or maps to.

affected products (22)

Products and version ranges known to be affected.

Mitel SIP Phone <R6.4.0.HF2all versionscert_bundDE
Mitel SIP Phone< R6.4.0.HF2cert_bundDE
n/a n/a≤ n/aenisa_euvdEU
Mitel Networks Corp. Mitel 6800 Series SIP Phone≤ R6.4.0.HF1 (R6.4.0.136)fstec_bduRU
Mitel Networks Corp. Mitel 6900 Series SIP Phone≤ R6.4.0.HF1 (R6.4.0.136)fstec_bduRU
Mitel Networks Corp. Mitel 6900w Series SIP Phone≤ R6.4.0.HF1 (R6.4.0.136)fstec_bduRU
Mitel Networks Corp. Mitel 6970 Conference Unit≤ R6.4.0.HF1 (R6.4.0.136)fstec_bduRU
mitel 6863i sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6863i_sip_firmware:*:*:*:*:*:*:*:*
mitel 6865i sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6865i_sip_firmware:*:*:*:*:*:*:*:*
mitel 6867i sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6867i_sip_firmware:*:*:*:*:*:*:*:*
mitel 6869i sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6869i_sip_firmware:*:*:*:*:*:*:*:*
mitel 6873i sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6873i_sip_firmware:*:*:*:*:*:*:*:*
mitel 6905 sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6905_sip_firmware:*:*:*:*:*:*:*:*
mitel 6910 sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6910_sip_firmware:*:*:*:*:*:*:*:*
mitel 6915 sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6915_sip_firmware:*:*:*:*:*:*:*:*
mitel 6920 sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6920_sip_firmware:*:*:*:*:*:*:*:*
mitel 6920w sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6920w_sip_firmware:*:*:*:*:*:*:*:*
mitel 6930 sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6930_sip_firmware:*:*:*:*:*:*:*:*
mitel 6930w sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6930w_sip_firmware:*:*:*:*:*:*:*:*
mitel 6940 sip firmware≤ 6.4.0.136nvdUScpe:2.3:o:mitel:6940_sip_firmware:*:*:*:*:*:*:*:*

showing 20 of 22

advisories (1)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2024-1662Mitel SIP-Telefon: Mehrere Schwachstellen ermöglichen CodeausführungDeutsch2024-07-17csaf · cert_bundDE
Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Mitel SIP Phone ausnutzen, um beliebigen Code auszuführen.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd NVD CVE.org MITRE

published 2024-08-12modified 2026-06-17

related (592)

Related entries.

ID	severity	EPSS	exploitable	published
CVE-2026-86060US	critical9.8OT critical	6.39% (94th)	KEV	2026-09-05
RouterOS contains an argument-handling flaw in the SSH login path involving usernames that begin with a prohibited character, allowing for the trusted RouterOS policy mask to be ch…
CVE-2026-24061US	—OT critical	99.0% (100th)	KEV	2026-01-21
telnetd in GNU Inetutils through 2.7 allows remote authentication bypass via a "-f root" value for the USER environment variable.
CVE-2024-4577US	critical9.8OT critical	100.0% (100th)	KEV	2024-06-09
In PHP versions 8.1.* before 8.1.29, 8.2.* before 8.2.20, 8.3.* before 8.3.8, when using Apache and PHP-CGI on Windows, if the system is set up to use certain code pages, Windows m…
CVE-2022-36804US	high8.8OT critical	99.1% (100th)	KEV	2022-08-25
Multiple API endpoints in Atlassian Bitbucket Server and Data Center 7.0.0 before version 7.6.17, from version 7.7.0 before version 7.17.10, from version 7.18.0 before version 7.21…
CVE-2016-10033US	critical9.8OT critical	99.7% (100th)	KEV	2016-12-30
The mailSend function in the isMail transport in PHPMailer before 5.2.18 might allow remote attackers to pass extra parameters to the mail command and consequently execute arbitrar…

+587 more

references (11)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan