EIP-c4542e4d
A stack-based buffer overflow vulnerability exists within multiple Mitel product web management interfaces, including the 3300 Controller and MiVoice Business product lines. Improper handling of the ‘Lang’ query parameter allows remote unauthenticated attackers to execute arbitrary code.
Vulnerability Identifiers
Exodus Intelligence: EIP-c4542e4d
MITRE CVE: TBD
Vulnerability Metrics
CVSSv2 Score: 10.0
Vendor References
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0005
Discovery Credit
Austin Martinetti and Brett Bryant working through the our Research Sponsorship Program (RSP).
Disclosure Timeline
Disclosed to affected vendor: April 21st, 2022
Disclosed to public: June 9th, 2022
Further Information
Readers of this advisory who are interested in receiving further details around the vulnerability, mitigations, detection guidance, and more can contact us at [email protected].
Researchers who are interested in monetizing their 0Day and NDay can work with us through our Research Sponsorship Program (RSP).
The post Mitel Web Management Interface Buffer Overflow Vulnerability appeared first on Exodus Intelligence.
Support the originator by clicking the read the rest link below.
