Mitel Product Security Advisory OBSO-2407-02

Unify OpenScape 4000 and Unify OpenScape 4000 Manager Command Injection Vulnerability in the Platform Webservice

Advisory ID: OBSO-2407-02

Publish Date: 2024-07-17

Last Updated: 2024-07-17

Revision: 1.0

 

Summary

A command injection vulnerability in the Platform Webservice component of Unify OpenScape 4000 and Unify OpenScape 4000 Manager, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit of this vulnerability could allow an attacker to execute arbitrary commands within the context of the system, with a potential impact on the confidentiality, integrity, and availability of the system.

The vulnerability severity is rated as critical. 

Credit and thanks are extended to Dr. Oliver Matula, Tim Kornhuber and Andreas Wagner of DB Systel GmbH for highlighting this issue and bringing it to our attention.

 

Affected Products

Product statements are related only to supported product versions. Products which have reached End of Support (M44) status are not considered. 

Products confirmed affected

 

Risk Assessment

CVSS3.1 Base score: 9.8 (Critical)

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

 

Mitigation / Recommended Action

Customers with affected product versions are advised to update the systems with the available fixes. 

Workarounds:

On the Unify OpenScape 4000 Manager V11 and the Unify OpenScape 4000 V10/V11:
  • As recommended in the "OpenScape 4000 V10R1 and Affiliated Products Security Checklist", chapter "7.8 Security Mode Configuration" set the “Restricted access to Platform Portal and SSH of Platform and CSTA” flag
    1. Navigate to Access Management -> Security Mode Configuration -> Application Access.
    2. Activate the mode "Restricted access to Platform Portal and SSH of Platform and CSTA"
On the Unify OpenScape 4000 Manager V10:
  • Enable the secure mode on the platform:
    • From the command line interface of the system, run the following command with root privileges:
      • /opt/webservice/scripts/swupdated set_ui_mode 1

Note: To disable secure mode, run the command: /opt/webservice/scripts/swupdated set_ui_mode 0

 

Revision History

Version Date Description
1.0 2024-07-17 Initial release


Advisory: OBSO-2407-02, status: general release
Security Advisories are released as part of Mitel Unify's Vulnerability Intelligence Process. For more information see https://www.mitel.com/support/security-advisories.

Contact and Disclaimer

Mitel Product Security Office
[email protected]
© Unify Software and Solutions GmbH & Co. KG 2024
Otto-Hahn-Ring 6
D-81739 München
www.mitel.com

The information provided in this document contains merely general descriptions or characteristics of performance which in case of actual use do not always apply as described or which may change as a result of further development of the products. An obligation to provide the respective characteristics shall only exist if expressly agreed in the terms of contract. Availability and technical specifications are subject to change without notice.
Unify, OpenScape, OpenStage and HiPath are registered trademarks of Unify Software and Solutions GmbH & Co. KG.

All other company, brand, product, and service names are trademarks or registered trademarks of their respective holders

Stay One Step Ahead

Ready to talk to sales? Contact us.
Find a Partner (844) 937-6483 Email Us