An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter.
References
| Link | Resource |
|---|---|
| https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis | Exploit Third Party Advisory |
| https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py | Product |
| https://www.youtube.com/watch?v=I9TQqfP5qzM | Exploit |
Configurations
Configuration 1 (hide)
| AND |
|
History
12 Jun 2024, 16:32
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Mitel 6869i Sip
Mitel Mitel 6869i Sip Firmware |
|
| CWE | CWE-77 | |
| CPE | cpe:2.3:h:mitel:6869i_sip:-:*:*:*:*:*:*:* cpe:2.3:o:mitel:6869i_sip_firmware:*:*:*:*:*:*:*:* |
|
| References | () https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis - Exploit, Third Party Advisory | |
| References | () https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py - Product | |
| References | () https://www.youtube.com/watch?v=I9TQqfP5qzM - Exploit | |
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 8.8 |
09 Jun 2024, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2024-06-09 20:15
Updated : 2024-07-03 02:04
NVD link : CVE-2024-37569
Mitre link : CVE-2024-37569
JSON object : View
Products Affected
mitel
- 6869i_sip
- 6869i_sip_firmware
CWE
CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')