CVE-2024-41710
Mitel SIP Phones Argument Injection Vulnerability
Description
CVE-2024-41710 is a high-severity argument injection vulnerability affecting Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through firmware version R6.4.0.HF1 (R6.4.0.136). The flaw allows an authenticated attacker with administrative privileges to inject arbitrary arguments during the boot process due to insufficient parameter sanitization, potentially leading to arbitrary command execution on the device. With a CVSS v3.1 base score of 7.2 and an EPSS score of 21.14% at the 95th percentile, this vulnerability presents a significant exploitation risk. CISA has added CVE-2024-41710 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 5, 2025, and public exploit code is available on GitHub.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| mitel | 6970 firmware | <= 6.4.0.136 |
| mitel | 6940w sip firmware | <= 6.4.0.136 |
| mitel | 6930w sip firmware | <= 6.4.0.136 |
| mitel | 6920w sip firmware | <= 6.4.0.136 |
| mitel | 6920 sip firmware | <= 6.4.0.136 |
| mitel | 6915 sip firmware | <= 6.4.0.136 |
| mitel | 6910 sip firmware | <= 6.4.0.136 |
| mitel | 6905 sip firmware | <= 6.4.0.136 |
| mitel | 6940 sip firmware | <= 6.4.0.136 |
| mitel | 6930 sip firmware | <= 6.4.0.136 |
| mitel | 6873i sip firmware | <= 6.4.0.136 |
| mitel | 6869i sip firmware | <= 6.4.0.136 |
| mitel | 6867i sip firmware | <= 6.4.0.136 |
| mitel | 6865i sip firmware | <= 6.4.0.136 |
| mitel | 6863i sip firmware | <= 6.4.0.136 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md(Exploit, Third Party Advisory)
- https://www.mitel.com/support/security-advisories(Vendor Advisory)
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41710(US Government Resource)
Weakness Type
Argument Injection via Insufficient Parameter Sanitization
CVE-2024-41710 arises from insufficient sanitization of parameters during the boot process of affected Mitel SIP phones. While no specific CWE has been formally assigned, the vulnerability aligns with argument injection weaknesses where attacker-controlled input is passed unsanitized to system commands or processes. The boot process on affected Mitel devices fails to properly validate or escape administrative input, allowing an authenticated attacker to inject additional arguments that alter the intended execution flow and achieve arbitrary command execution on the underlying operating system.
Impact Analysis
CVE-2024-41710 poses a serious risk to organizations deploying Mitel SIP phones across their telecommunications infrastructure. The CVSS vector (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) indicates the vulnerability is exploitable over the network with low attack complexity, though it requires high-privilege (administrative) access. Confidentiality (High): A successful exploit grants the attacker access to sensitive data on the phone, including call records, SIP credentials, network configuration details, and potentially intercepted voice communications. Integrity (High): Arbitrary command execution allows the attacker to modify device firmware, alter phone configurations, redirect calls, install persistent backdoors, or pivot to other networked devices. Availability (High): An attacker can disrupt phone operations by crashing the device, disabling services, or rendering the phone inoperable. The EPSS score of 21.14% at the 95th percentile indicates a substantially elevated likelihood of exploitation. While the ransomware association for this CVE is currently listed as unknown, the ability to execute arbitrary commands on network-connected VoIP devices makes this an attractive target for attackers seeking lateral movement within enterprise networks.
Exploit Maturity
CVE-2024-41710 demonstrates significant exploit maturity with confirmed active exploitation. Public exploit code is available on GitHub at kwburns/CVE Mitel exploit repository, providing detailed technical information about the argument injection technique during the boot process. CISA has confirmed active exploitation in the wild by including this vulnerability in the Known Exploited Vulnerabilities catalog, with a mandatory remediation deadline of March 5, 2025. The EPSS score of 21.14% at the 95th percentile places this vulnerability well above typical exploitation thresholds, indicating widespread awareness and active targeting by threat actors. The ransomware use status is currently listed as unknown, but the combination of public exploit code and confirmed active exploitation warrants immediate remediation.
Remediation
-
Update firmware to the latest patched version. Mitel has released firmware updates that address CVE-2024-41710. Upgrade all affected Mitel 6800 Series, 6900 Series, 6900w Series SIP Phones, and 6970 Conference Units to firmware versions beyond R6.4.0.HF1 (R6.4.0.136). Consult the Mitel Security Advisory 24-0019 for specific patched firmware versions and download links.
-
Restrict administrative access to SIP phones. Since exploitation requires administrative privileges, immediately audit and limit administrative accounts on all affected devices. Implement strong, unique passwords for each device, enforce multi-factor authentication where supported, and restrict management interface access to trusted network segments using firewall rules and VLANs.
-
Isolate VoIP infrastructure on dedicated network segments. Deploy affected SIP phones on dedicated VLANs separated from general user and server networks. Apply strict firewall rules that only allow necessary SIP signaling and media traffic, blocking unnecessary management protocols from untrusted networks.
-
Monitor for indicators of compromise. Review device logs and network traffic for anomalous boot sequences, unexpected command execution, or unauthorized configuration changes on affected Mitel phones. Deploy network intrusion detection rules targeting the known exploit patterns described in the public exploit code.
-
Establish a VoIP device patch management program. Ensure all Mitel SIP phones are included in regular vulnerability scanning and patch management cycles. Subscribe to Mitel security advisories for timely notification of future vulnerabilities.
Technical Details
CVE-2024-41710 is an argument injection vulnerability in the boot process of Mitel SIP phones. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H indicates that the vulnerability is network-exploitable with low complexity, but requires the attacker to hold high-level (administrative) privileges on the device. No user interaction is needed, and the scope is unchanged, meaning impact is confined to the vulnerable component. The root cause lies in insufficient parameter sanitization during the device boot process. When the phone initializes, certain configuration parameters provided through the administrative interface are passed to system-level commands without adequate validation or escaping. An authenticated administrator can craft malicious input containing injected arguments that are interpreted by the underlying operating system during boot, resulting in arbitrary command execution with the privileges of the boot process. The affected firmware versions span the Mitel 6800 Series (models 6863i, 6865i, 6867i, 6869i, 6873i), 6900 Series (models 6905, 6910, 6915, 6920, 6930, 6940), 6900w Series (models 6920w, 6930w, 6940w), and the 6970 Conference Unit, all running firmware version R6.4.0.136 or earlier.
Frequently Asked Questions
Is CVE-2024-41710 being actively exploited?
Yes. CISA has confirmed active exploitation in the wild by adding CVE-2024-41710 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 5, 2025. Public exploit code is available on GitHub, and the EPSS score of 21.14% at the 95th percentile indicates a substantially elevated likelihood of exploitation.
What Mitel products are affected by CVE-2024-41710?
CVE-2024-41710 affects a wide range of Mitel SIP phones: the 6800 Series (6863i, 6865i, 6867i, 6869i, 6873i), the 6900 Series (6905, 6910, 6915, 6920, 6930, 6940), the 6900w Series (6920w, 6930w, 6940w), and the 6970 Conference Unit. All devices running firmware version R6.4.0.136 or earlier are vulnerable.
How do I fix CVE-2024-41710?
Update the firmware on all affected Mitel SIP phones to the latest version provided by Mitel. Consult Mitel Security Advisory 24-0019 for specific patch information. As an interim measure, restrict administrative access to trusted networks and enforce strong authentication for device management interfaces.
Does CVE-2024-41710 require authentication to exploit?
Yes. The vulnerability requires the attacker to have high-level administrative privileges on the affected device. However, this should not diminish the urgency of remediation, as administrative credentials may be obtained through credential theft, default passwords, or other attack vectors, and the impact of successful exploitation is complete device compromise.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.