[ Vendor · 18 CVEs ]
Mitel
CVEs affecting Mitel published in the last 30 days, plus any Mitel CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-104809 | 5 Oct 2026 | CVSS 8.4 | Mitel MiVoice Office 400DigitalCanion has discovered a vulnerability that allows an attacker to cause the system to load an attacker-controlled .so file instead of the… | |
| CVE-2026-104810 | 5 Oct 2026 | CVSS 8.4 | Mitel MiVoice Office 400This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is… | |
| CVE-2026-104811 | 5 Oct 2026 | CVSS 8.4 | Mitel MiVoice Office 400DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product… | |
| CVE-2026-104706 | 5 Oct 2026 | CVSS 8.4 | Mitel MiVoice Office 400DigitalCanion has discovered a path traversal vulnerability that allows to view or download sensitive system files over the portal https://<ip>:8443… | |
| CVE-2026-104805 | 5 Oct 2026 | CVSS 8.5 | Mitel MiVoice Office 400DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup… | |
| CVE-2026-104806 | 5 Oct 2026 | CVSS 5.5 | Mitel MiVoice Office 400DigitalCanion has discovered a path traversal vulnerability that allows an attacker to access files outside of the intended directory. The specific… | |
| CVE-2026-104807 | 5 Oct 2026 | CVSS 1.9 | Mitel MiVoice Office 400DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent… | |
| CVE-2026-104808 | 5 Oct 2026 | CVSS 1.9 | Mitel MiVoice Office 400DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent… | |
| CVE-2024-55550 | 10 Dec 2024 | CVSS 2.7 | Mitel MiCollab Path TraversalMitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient… | Exploited |
| CVE-2024-41713 | 21 Oct 2024 | CVSS 9.1 | Mitel MiCollab Path TraversalA vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated… | Exploited |
| CVE-2024-41713 | 21 Oct 2024 | CVSS 9.1 | Mitel MiCollab Path TraversalA vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated… | Exploited |
| CVE-2024-41710 | 12 Aug 2024 | CVSS 7.2 | Mitel SIP Phones Argument InjectionA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1… | Exploited |
| CVE-2024-41710 | 12 Aug 2024 | CVSS 7.2 | Mitel SIP Phones Argument InjectionA vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1… | Exploited |
| CVE-2022-41223 | 22 Nov 2022 | CVSS 6.8 | Mitel MiVoice Connect Code InjectionThe Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection… | Exploited |
| CVE-2022-40765 | 22 Nov 2022 | CVSS 6.8 | Mitel MiVoice Connect Command InjectionA vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with… | Exploited |
| CVE-2022-29499 | 26 Apr 2022 | CVSS 9.8 | Mitel MiVoice Connect Data ValidationThe Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The… | Exploited |
| CVE-2022-26143 | 10 Mar 2022 | CVSS 9.8 | MiCollab, MiVoice Business Express Access ControlThe TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain… | Exploited |
| CVE-2014-0160 | 7 Apr 2014 | CVSS 7.5 | OpenSSL Information DisclosureThe (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote… | ExploitedFix |