Access Control Vulnerabilities in Mitel SIP Phones

Vulnerabilities in the firmware of Mitel 6800/6900 phones could allow a physical attacker to gain root privileges on the phone

Threat ID:: CC-4113
Category:: Backdoor
Threat Severity:: Information only
Published:: 17 June 2022 11:46 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Vulnerabilities in the firmware of Mitel 6800/6900 phones could allow a physical attacker to gain root privileges on the phone

Affected platforms

The following platforms are known to be affected:

Versions: Mitel 6800 Series and 6900 Series excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 through 6.1 HF4, Mitel 6900 Series IP, versions MiNet 1.8.0.12 and earlier

Mitel SIP Phones

Threat details

Introduction

Mitel has released advisories for access control vulnerabilities affecting Mitel 6800 and 6900 products. The first vulnerability, tracked as CVE-2022-29855, affects the firmware of Mitel 6800 and 6900 desk phones. The second, CVE-2022-29854, affects Mitel 6900 Series IP (excluding 6970) using MiNet firmware.

The vulnerabilities are due to insufficient access control functionality and each has a Medium CVSS rating of 6.8. An unauthenticated attacker, with physical access to the phone, could gain high-level privileges, which could be used to access sensitive information or perform code execution in the context of the device.

Remediation advice

Affected organisations are encouraged to review Mitel Security Advisories 22-0003 and 22-0004 and apply the necessary updates.

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2022-29855

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.

Status Published

CVE-2022-29854

A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.

Last edited: 27 June 2022 5:12 pm