CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-40765 – Mitel MiVoice Connect Command Injection Vulnerability
https://notcve.org/view.php?id=CVE-2022-40765
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network access to conduct a command-injection attack, due to insufficient restriction of URL parameters. Una vulnerabilidad en el componente Edge Gateway de Mitel MiVoice Connect hasta la versión 19.3 (22.22.6100.0) podría permitir que un atacante autenticado con acceso a la red interna lleve a cabo un ataque de inyección de comandos, debido a una restricción insuficiente de los parámetros de URL. The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system. • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0007 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 6.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-41223 – Mitel MiVoice Connect Code Injection Vulnerability
https://notcve.org/view.php?id=CVE-2022-41223
The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type. El componente de base de datos Director de MiVoice Connect hasta la versión 19.3 (22.22.6100.0) podría permitir a un atacante autenticado realizar un ataque de inyección de código a través de datos manipulados debido a restricciones insuficientes en el tipo de datos de la base de datos. The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application. • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0008 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 0CVE-2022-31784
https://notcve.org/view.php?id=CVE-2022-31784
A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to the management interface) to conduct a buffer overflow attack due to insufficient validation of URL parameters. A successful exploit could allow arbitrary code execution. Una vulnerabilidad en la interfaz de administración de MiVoice Business versiones hasta 9.3 PR1 y MiVoice Business Express versiones hasta 8.0 SP3 PR3 podría permitir a un atacante no autenticado (que tenga acceso a la red de la interfaz de administración) conducir un ataque de desbordamiento del búfer debido a una comprobación insuficiente de los parámetros de la URL. Una explotación con éxito podría permitir la ejecución de código arbitrario • https://www.mitel.com/support/security-advisories https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0005 • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') •
CVSS: 10.0EPSS: 2%CPEs: 1EXPL: 0CVE-2022-29499 – Mitel MiVoice Connect Data Validation Vulnerability
https://notcve.org/view.php?id=CVE-2022-29499
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA. El componente Service Appliance en Mitel MiVoice Connect versiones hasta 19.2 SP3, permite una ejecución de código remota debido a una comprobación incorrecta de los datos. Los Service Appliances son SA 100, SA 400 y Virtual SA The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation. • https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002 • CWE-20: Improper Input Validation •
CVSS: 9.8EPSS: 5%CPEs: 4EXPL: 1CVE-2022-26143 – MiCollab, MiVoice Business Express Access Control Vulnerability
https://notcve.org/view.php?id=CVE-2022-26143
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance degradation and excessive outbound traffic). This was exploited in the wild in February and March 2022 for the TP240PhoneHome DDoS attack. El componente TP-240 (también conocido como tp240dvr) en Mitel MiCollab versiones anteriores a 9.4 SP1 FP1 y MiVoice Business Express versiones hasta 8.1, permite a atacantes remotos obtener información confidencial y causar una denegación de servicio (degradación del rendimiento y tráfico saliente excesivo). Esto fue explotado "in the wild" en febrero y marzo de 2022 para el ataque DDoS TP240PhoneHome A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a denial of service condition on the affected system. • https://arstechnica.com/information-technology/2022/03/ddosers-use-new-method-capable-of-amplifying-traffic-by-a-factor-of-4-billion https://blog.cloudflare.com/cve-2022-26143 https://news.ycombinator.com/item?id=30614073 https://team-cymru.com/blog/2022/03/08/record-breaking-ddos-potential-discovered-cve-2022-26143 https://www.akamai.com/blog/security/phone-home-ddos-attack-vector https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-22-0001 https://www.sha • CWE-306: Missing Authentication for Critical Function •