A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.
References
| Link | Resource |
|---|---|
| https://www.mitel.com/support/security-advisories | Vendor Advisory |
| https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006 | Vendor Advisory |
| https://www.mitel.com/support/security-advisories | Vendor Advisory |
| https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006 | Vendor Advisory |
Configurations
History
21 Nov 2024, 08:01
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://www.mitel.com/support/security-advisories - Vendor Advisory | |
| References | () https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006 - Vendor Advisory |
01 Jun 2023, 16:10
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-640 | |
| CPE | cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:* | |
| References | (MISC) https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006 - Vendor Advisory | |
| References | (MISC) https://www.mitel.com/support/security-advisories - Vendor Advisory | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
24 May 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-05-24 20:15
Updated : 2024-11-21 08:01
NVD link : CVE-2023-31459
Mitre link : CVE-2023-31459
CVE.ORG link : CVE-2023-31459
JSON object : View
Products Affected
mitel
- mivoice_connect
CWE
CWE-640
Weak Password Recovery Mechanism for Forgotten Password