fkie_cve-2025-47187
Vulnerability from fkie_nvd
Published
2025-07-23 19:15
Modified
2025-07-29 20:15
Severity ?
Summary
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to perform a file upload attack due to missing authentication mechanisms. A successful exploit could allow an attacker to upload arbitrary WAV files, which may potentially exhaust the phone’s storage without affecting the phone's availability or operation.
References
Impacted products
| Vendor | Product | Version |
|---|
{
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to perform a file upload attack due to missing authentication mechanisms. A successful exploit could allow an attacker to upload arbitrary WAV files, which may potentially exhaust the phone\u2019s storage without affecting the phone\u0027s availability or operation."
},
{
"lang": "es",
"value": "Una vulnerabilidad en los tel\u00e9fonos SIP Mitel de las series 6800, 6900 y 6900w, incluyendo la unidad de conferencia 6970 hasta la versi\u00f3n 6.4 SP4, podr\u00eda permitir a un atacante no autenticado realizar un ataque de carga de archivos debido a la falta de mecanismos de autenticaci\u00f3n. Una explotaci\u00f3n exitosa podr\u00eda permitir a un atacante cargar archivos WAV arbitrarios, lo que podr\u00eda agotar la capacidad de almacenamiento del tel\u00e9fono sin afectar su disponibilidad ni funcionamiento."
}
],
"id": "CVE-2025-47187",
"lastModified": "2025-07-29T20:15:27.133",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
},
"published": "2025-07-23T19:15:33.270",
"references": [
{
"source": "cve@mitre.org",
"url": "https://www.mitel.com/support/security-advisories"
},
{
"source": "cve@mitre.org",
"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0004"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Awaiting Analysis",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-434"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…