CVE-2022-29855
Medium
Description
Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
SeverityMedium
CVSS6.8
Exploit probability—
Product
Mitel 6873i Sip Firmware
PublishedMay 11, 2022
First seenMay 11, 2022
How to fix
Update
- mitel 6873i_sip_firmware5.1.0.8017, 6.1.0.171 or later
- mitel 6930_sip_firmware5.1.0.8017, 6.1.0.171 or later
- mitel 6940_sip_firmware5.1.0.8017, 6.1.0.171 or later
- mitel 6865i_sip_firmware5.1.0.8017, 6.1.0.171 or later
- mitel 6867i_sip_firmware5.1.0.8017, 6.1.0.171 or later
- mitel 6869i_sip_firmware5.1.0.8017, 6.1.0.171 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| mitel 6873i_sip_firmware | v < 5.1.0.8017, 6.0.0.368 ≤ v < 6.1.0.171 | 5.1.0.8017, 6.1.0.171 |
| mitel 6930_sip_firmware | v < 5.1.0.8017, 6.0.0.368 ≤ v < 6.1.0.171 | 5.1.0.8017, 6.1.0.171 |
| mitel 6940_sip_firmware | v < 5.1.0.8017, 6.0.0.368 ≤ v < 6.1.0.171 | 5.1.0.8017, 6.1.0.171 |
| mitel 6865i_sip_firmware | v < 5.1.0.8017, 6.0.0.368 ≤ v < 6.1.0.171 | 5.1.0.8017, 6.1.0.171 |
| mitel 6867i_sip_firmware | v < 5.1.0.8017, 6.0.0.368 ≤ v < 6.1.0.171 | 5.1.0.8017, 6.1.0.171 |
| mitel 6869i_sip_firmware | v < 5.1.0.8017, 6.0.0.368 ≤ v < 6.1.0.171 | 5.1.0.8017, 6.1.0.171 |
| mitel 6920_sip_firmware | v ≤ 5.1.0.8016, 6.0.0.368 ≤ v ≤ 6.1.0.165 | — |
| mitel 6910_sip_firmware | v ≤ 5.1.0.8016, 6.0.0.368 ≤ v ≤ 6.1.0.165 | — |
| mitel 6905_sip_firmware | v ≤ 5.1.0.8016, 6.0.0.368 ≤ v ≤ 6.1.0.165 | — |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.