CVE-2024-41710
Published: February 12, 2025
Official Description
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.
CISA KEV Advisory
Mitel SIP Phones Argument Injection Vulnerability
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This vulnerability in Mitel 6800, 6900, and 6900w Series SIP Phones, including the 6970 Conference Unit, is an argument injection flaw during the boot process. Successful exploitation can allow an attacker to execute arbitrary commands on the system. The high EPSS score indicates a significant likelihood of exploitation, and its presence in the KEV catalog confirms it has been actively exploited, making it an urgent concern for users of these phones.
This vulnerability has been actively exploited in the wild. The flaw during the boot process suggests potential for remote exploitation if an attacker can interfere with the boot sequence or supply malicious parameters.
Apply the latest firmware updates for affected Mitel SIP Phones. Secure the network environment where these phones operate to prevent unauthorized access to their boot process.
Technical Analysis
CVE-2024-41710 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2024-41710 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2024-41710 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1