CVE-2023-39288

Vulnerability

A command argument injection vulnerability exists in the Connect Mobility Router component of Mitel MiVoice Connect through version 9.6.2304.102. The flaw arises from insufficient parameter sanitization, allowing an authenticated attacker with elevated privileges and internal network access to inject commands into a router function [1][2].

Exploitation

An attacker must be authenticated with elevated privileges and have internal network access to the affected device. The attacker can then send specially crafted requests containing injected command arguments to the Mobility Router; no additional user interaction or race condition is required [1][2].

Impact

Successful exploitation permits the attacker to access network information and to generate excessive network traffic, potentially leading to denial-of-service conditions or information disclosure. The compromise is limited to the scope of the router process and does not directly provide root-level access on the host system [1][2].

Mitigation

Mitel has released updated software to address the vulnerability. Customers are advised to update their MiVoice Connect installation to the latest version (post 9.6.2304.102) as recommended in Mitel Product Security Advisory 23-0011. No workaround is documented; the sole recommended action is to apply the software update [2].