CVE-2023-39288
MediumCVSS 5.5Exploitation Probability (EPSS)
Low risk39th percentile - higher than 39% of all known CVEs
Summary
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through version 9.6.2304.102 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization.
Risk Assessment
A successful exploit could allow an attacker to access network information and to generate excessive network traffic, potentially impacting the performance and security of the organization's network.
Recommendation
It is recommended to update to the latest version of Mitel MiVoice Connect to mitigate this vulnerability and to implement additional security measures to monitor and restrict access to the internal network.
Other vulnerabilities in Connect Mobility Router
See all- CVE-2023-39291Medium
A vulnerability in the Connect Mobility Router component of MiVoice Connect through version 9.6.2304.102 could allow an authenticated attacker with elevated privileges to conduct an information disclosure attack due to improper configuration.
- CVE-2023-39289High
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker to access system information.
Original NVD description (English source)
A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges and internal network access to conduct a command argument injection due to insufficient parameter sanitization. A successful exploit could allow an attacker to access network information and to generate excessive network traffic.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS