High severity · published Dec 18, 2020
CVE-2020-27639
The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a…
8.1
CVSS
0.5%
EPSS
No
On KEV
Description
The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations.
CVSS vector
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H
Attack vector
Adjacent
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.5% · higher than 44% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6S
6873i Sip Firmware · Mitel
before 5.1.0; 5.1.0; 5.1.0; 5.1.0; 5.1.0; 5.1.0; +1 more · source: NVD
6S
6930 Sip Firmware · Mitel
before 5.1.0; 5.1.0; 5.1.0; 5.1.0; 5.1.0; 5.1.0; +1 more · source: NVD
6S
6940 Sip Firmware · Mitel
before 5.1.0; 5.1.0; 5.1.0; 5.1.0; 5.1.0; 5.1.0; +1 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2020-27639
CVE.org
https://www.cve.org/CVERecord?id=CVE-2020-27639
Vendor Advisory
https://www.mitel.com/support/security-advisories
More from 6873i Sip Firmware
7.2
CVE-2024-41710
Mitel SIP Phones Argument Injection Vulnerability
6.8
CVE-2022-29855
Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970,…