Live › vulnerability › CVE-2024-41710
Go to dashboardMitel 6800, 6900 and 6900w Series SIP phones, including the 6970 Conference Unit, have an argument injection flaw in their boot process caused by weak parameter sanitization. An attacker who can reach the phone can run arbitrary commands on it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Mitel SIP Phones | vendor | – | – |
| mitel 6970 firmware | vendor | <= 6.4.0.136 | – |
| mitel 6940w sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6930w sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6920w sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6920 sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6915 sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6910 sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6905 sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6940 sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6930 sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6873i sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6869i sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6867i sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6865i sip firmware | vendor | <= 6.4.0.136 | – |
| mitel 6863i sip firmware | vendor | <= 6.4.0.136 | – |
Unknown from the sources.
Apply the mitigations the vendor publishes for this issue, or stop using the affected phones if no mitigation is available (per CISA required action).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2024-41710")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.