CVE-2023-31458

Vulnerability

A default password vulnerability exists in the Edge Gateway component of Mitel MiVoice Connect. Versions 19.3 SP2 (22.24.1500.0) and earlier do not enforce a password change during initial installation, leaving the device with known default credentials. An unauthenticated attacker with internal network access can exploit this to gain administrative privileges. [2]

Exploitation

An attacker with internal network access can connect to the Edge Gateway and use the default credentials to authenticate. No prior authentication or user interaction is required. The attacker can then perform administrative actions such as modifying configuration or executing commands. [2]

Impact

Successful exploitation grants the attacker full administrative privileges, allowing arbitrary configuration changes and remote command execution on the affected device. This can lead to complete compromise of the Edge Gateway and potentially the broader network. [2]

Mitigation

Mitel has released updated software versions that address this vulnerability. Customers should update to the latest release and enforce complex passwords for all Edge Gateway accounts. As a workaround, ensure that default credentials are changed immediately after installation. [2]