CVE-2023-39289

Vulnerability

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through version 9.6.2208.101 allows an unauthenticated attacker to enumerate valid accounts due to improper configuration. This information disclosure issue is identified in advisory 23-0011 [2].

Exploitation

An attacker with network access to the device can send crafted requests to enumerate usernames without any authentication required. No user interaction is needed. The exact steps are not detailed, but the vulnerability relies on the improper configuration of the Mobility Router, as noted in the advisory [2].

Impact

Successful exploitation allows the attacker to obtain system information, specifically valid account names, which could aid in further attacks such as brute force or targeted phishing. The risk is rated as medium [2].

Mitigation

Mitel has released software version 9.6.2304.102 which fixes this vulnerability. Customers are advised to update to the latest release. No workaround is provided. The advisory recommends contacting Product Support for additional information [2].