Medium severity · published May 11, 2022
CVE-2022-29855
Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970,…
6.8
CVSS
0.8%
EPSS
No
On KEV
Description
Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.
CVSS vector
CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Physical
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.8% · higher than 56% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
6S
6865i Sip Firmware · Mitel
before 5.1.0.8017; 6.0.0.368 before 6.1.0.171 · source: NVD
6S
6867i Sip Firmware · Mitel
before 5.1.0.8017; 6.0.0.368 before 6.1.0.171 · source: NVD
6S
6869i Sip Firmware · Mitel
before 5.1.0.8017; 6.0.0.368 before 6.1.0.171 · source: NVD
6S
6873i Sip Firmware · Mitel
before 5.1.0.8017; 6.0.0.368 before 6.1.0.171 · source: NVD
6S
6905 Sip Firmware · Mitel
through 5.1.0.8016; 6.0.0.368 through 6.1.0.165 · source: NVD
6S
6910 Sip Firmware · Mitel
through 5.1.0.8016; 6.0.0.368 through 6.1.0.165 · source: NVD
6S
6920 Sip Firmware · Mitel
through 5.1.0.8016; 6.0.0.368 through 6.1.0.165 · source: NVD
6S
6930 Sip Firmware · Mitel
before 5.1.0.8017; 6.0.0.368 before 6.1.0.171 · source: NVD
6S
6940 Sip Firmware · Mitel
before 5.1.0.8017; 6.0.0.368 before 6.1.0.171 · source: NVD