Mitel Product Security Advisory 22-0004

Mitel 6800 Series SIP Phone and 6900 Series SIP Phone Access Control Vulnerability

Advisory ID: 22-0004

Publish Date: 2022-05-03

Last Updated: 2022-05-03

Revision: 1.0

Summary

An access control vulnerability has been identified in Mitel 6800 Series SIP Phones and 6900 Series SIP phones (excluding the 6970) running SIP firmware. If successfully exploited could allow a malicious actor access to code execution.

Mitel is recommending customers with affected product versions apply the available remediation.

This vulnerability was privately reported to Mitel.

Credit is given to Moritz Abrell of SySS GmbH for highlighting the issue and bringing to our attention.

Affected Products

Product Name

Product Version

Security Bulletin

Last Updated

Mitel 6800/6900 Series SIP Phones

Rel 5.1 SP8 and earlier
Rel 6.0 to 6.1 HF4

22-0004-001

2022-05-03

The vulnerability impacts all 6800 and 6900 Series SIP phones excluding the 6970 model.

Risk Assessment

The risk of this vulnerability is rated as Medium.

This vulnerability relates to Mitel 6800 Series SIP Phones and 6900 Series SIP Phones firmware (excluding 6970).

Refer to the product Security Bulletin for additional statements regarding risk.

Mitigation / Recommended Action

Mitel has issued a new release of the affected firmware. Customers are advised to update their 6800 IP and 6900 IP Phones to the latest version.

Customers are advised to review the product Security Bulletin.

For additional information, contact Product Support.

Related CVEs / CWEs / Advisories

CVE-2022-29855

Revision History

Version	Date	Description
1.0	2022-05-03	Initial Version