CVE-2023-31459

Vulnerability

The Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier contains a default password vulnerability [2]. During initial installation, the system does not enforce a password change for the administrative account, leaving the default credentials active.

Exploitation

An unauthenticated attacker with internal network access to the Mobility Router can exploit this by connecting to the management interface and authenticating with the known default credentials [2]. No additional privileges or user interaction are required.

Impact

Successful exploitation grants the attacker administrative privileges on the router, enabling arbitrary configuration changes and execution of arbitrary commands, leading to full compromise of the affected device [2].

Mitigation

Mitel recommends that customers update to the latest software release and ensure that complex passwords are configured for all Connect Mobility Router accounts [2]. The official advisory (23-0006) was published on 2023-05-17. No workaround is available beyond applying the update and setting strong passwords.