CVE-2023-39291

Vulnerability

An information disclosure vulnerability exists in the Connect Mobility Router component of MiVoice Connect through version 9.6.2304.102 [2]. This is due to improper configuration, allowing an authenticated attacker with elevated privileges to access system information.

Exploitation

An attacker must be authenticated with elevated privileges on the affected system. No additional user interaction is required. The attacker can leverage the improper configuration to view system information, such as configuration details or sensitive data.

Impact

Successful exploitation results in unauthorized disclosure of system information, compromising confidentiality. The attacker already has elevated privileges, so no privilege escalation occurs, but sensitive data may be exposed.

Mitigation

Mitel has released software updates to address this vulnerability [2]. Customers are advised to update their MiVoice Connect installations to the latest version. No workarounds have been provided. The vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog.