Mitel 3300 Controller HTTP Buffer Overflow Vulnerability

EIP-c4542e4d

A stack-based buffer overflow vulnerability exists within the Mitel 3300 controller’s web management interface. Improper parsing of the ‘lang’ query parameter allows remote unauthenticated attackers to execute arbitrary code.

Vulnerability Identifiers

Exodus Intelligence: EIP-c4542e4dMITRE CVE: TBD

Vulnerability Metrics

CVSSv2 Score: 10.0

Vendor References

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0005

Discovery Credit

Exodus Intelligence

Disclosure Timeline

Disclosed to affected vendor: April 21st, 2022Disclosed to public: June 9th, 2022

Further Information

Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at [email protected].

Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program.

The post Mitel 3300 Controller HTTP Buffer Overflow Vulnerability appeared first on Exodus Intelligence.

Support the originator by clicking the read the rest link below.