CVE-2023-31459

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector ADJACENT_NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.mitel.com/support/security-advisories	Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2023-05-24 20:15

Updated : 2023-06-01 16:10

NVD link : CVE-2023-31459

Mitre link : CVE-2023-31459

CVE.ORG link : CVE-2023-31459

JSON object : View

Products Affected

mitel

mivoice_connect

CWE

CWE-640

Weak Password Recovery Mechanism for Forgotten Password

{"id": "CVE-2023-31459", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.8}]}, "published": "2023-05-24T20:15:10.033", "references": [{"url": "https://www.mitel.com/support/security-advisories", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0006", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-640"}]}], "descriptions": [{"lang": "en", "value": "A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands."}], "lastModified": "2023-06-01T16:10:15.467", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "530AA583-2289-491E-985F-07A5915A637C", "versionEndIncluding": "9.6.2208.101"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}

8.8 /10