CVSS: 8.8EPSS: 0%CPEs: 3EXPL: 2CVE-2024-37569
https://notcve.org/view.php?id=CVE-2024-37569
An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter. • https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis https://www.youtube.com/watch?v=I9TQqfP5qzM • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2024-37570
https://notcve.org/view.php?id=CVE-2024-37570
On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an authenticated user) before appending flags to the busybox ftpget command. This leads to $() command execution. En dispositivos Mitel 6869i 4.5.0.41, la página Actualización manual de firmware (upgrade.html) no realiza sanitización en los parámetros de nombre de usuario y ruta (enviados por un usuario autenticado) antes de agregar indicadores al comando ftpget de Busybox. Esto lleva a la ejecución del comando $(). • https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-firmware.py https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-firmware • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40266
https://notcve.org/view.php?id=CVE-2023-40266
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal. Se descubrió un problema en Atos Unify OpenScape Xpressions WebAssistant V7 anterior a V7R1 FR5 HF42 P911. Permite el path traversal. • https://networks.unify.com/security/advisories/OBSO-2305-03.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-40265
https://notcve.org/view.php?id=CVE-2023-40265
An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file upload. Se descubrió un problema en Atos Unify OpenScape Xpressions WebAssistant V7 anterior a V7R1 FR5 HF42 P911. Permite la ejecución remota de código autenticado mediante la carga de archivos. • https://networks.unify.com/security/advisories/OBSO-2305-03.pdf • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-39285
https://notcve.org/view.php?id=CVE-2023-39285
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cross Site Request Forgery (CSRF) attack due to insufficient request validation. A successful exploit could allow an attacker to provide a modified URL, potentially enabling them to modify system configuration settings. Una vulnerabilidad en el componente Edge Gateway de Mitel MiVoice Connect hasta 19.3 SP3 (22.24.5800.0) podría permitir que un atacante no autenticado realice un ataque de Cross Site Request Forgery (CSRF) debido a una validación de la solicitud insuficiente. Un exploit exitoso podría permitir a un atacante proporcionar una URL modificada, lo que potencialmente le permitiría modificar la configuración del sistema. • https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0014 • CWE-352: Cross-Site Request Forgery (CSRF) •