Mitel
135 CVEs across 128 Mitel products. Browse Mitel vulnerabilities, severities, and proof-of-concept exploits.
Mitel products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-67823 | High | 8.2 | 2026-01-15 | A vulnerability in the Multimedia Email component of Mitel MiContact Center Business through 10.2.0.10 and Mitel CX through 1.1.0.1 could allow an unauthentica… |
CVE-2025-67822 | Critical | 9.4 | 2026-01-15 | A vulnerability in the Provisioning Manager component of Mitel MiVoice MX-ONE 7.3 (7.3.0.0.50) through 7.8 SP1 (7.8.1.0.14) could allow an unauthenticated atta… |
CVE-2025-52914 | High | 8.8 | 2025-08-08 | A vulnerability in the Suite Applications Services component of Mitel MiCollab 10.0 through SP1 FP1 (10.0.1.101) could allow an authenticated attacker to condu… |
CVE-2024-55550 | Low | 2.7 | 2024-12-10 | Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sani… |
CVE-2024-47224 | Medium | 6.5 | 2024-10-21 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attac… |
CVE-2024-41714 | High | 8.8 | 2024-10-21 | A vulnerability in the Web Interface component of Mitel MiCollab through 9.8 SP1 (9.8.1.5) and MiVoice Business Solution Virtual Instance (MiVB SVI) through 1… |
CVE-2024-41713 | Critical | 9.1 | 2024-10-21 | A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to c… |
CVE-2024-41712 | Medium | 6.6 | 2024-10-21 | A vulnerability in the Web Conferencing Component of Mitel MiCollab through 9.8.1.5 could allow an authenticated attacker to conduct a command injection attack… |
CVE-2024-35315 | Medium | 5.6 | 2024-10-21 | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an a… |
CVE-2024-35314 | Critical | 9.8 | 2024-10-21 | A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, could allow an u… |
CVE-2024-35287 | Medium | 6.7 | 2024-10-21 | A vulnerability in the NuPoint Messenger (NPM) component of Mitel MiCollab through version 9.8 SP1 (9.8.1.5) could allow an authenticated attacker with adminis… |
CVE-2024-35286 | Critical | 9.8 | 2024-10-21 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection attack due to insuf… |
CVE-2024-35285 | Critical | 9.8 | 2024-10-21 | A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection attack due to i… |
CVE-2024-30160 | Medium | 4.8 | 2024-10-21 | A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative priv… |
CVE-2024-30159 | Medium | 4.8 | 2024-10-21 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to c… |
CVE-2024-30158 | High | 7.2 | 2024-10-21 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative privileges to c… |
CVE-2024-30157 | High | 7.2 | 2024-10-21 | A vulnerability in the Suite Applications Services component of Mitel MiCollab through 9.7.1.110 could allow an authenticated attacker with administrative priv… |
CVE-2024-47912 | High | 8.2 | 2024-10-21 | A vulnerability in the AWV (Audio, Web, and Video) Conferencing component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated atta… |
CVE-2024-47223 | Critical | 9.4 | 2024-10-21 | A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attac… |
CVE-2024-47189 | High | 7.7 | 2024-10-21 | The API Interface of the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated att… |
CVE-2024-42514 | High | 8.1 | 2024-10-01 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.1.0.4 could allow an unauthenticated attacker to conduct an unauthor… |
CVE-2024-36446 | High | 8.8 | 2024-08-13 | The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due… |
CVE-2024-41710 | High | 7.2 | 2024-08-12 | A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could a… |
CVE-2024-37570 | High | 8.8 | 2024-06-09 | On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an a… |
CVE-2024-37569 | High | 8.8 | 2024-06-09 | An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter… |
CVE-2024-35284 | Medium | 5.4 | 2024-05-29 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected… |
CVE-2024-35283 | Medium | 6.1 | 2024-05-29 | A vulnerability in the Ignite component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a stored cross-s… |
CVE-2024-28066 | High | 8.8 | 2024-04-08 | In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password). |
CVE-2024-28070 | Medium | 6.8 | 2024-03-16 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct a reflected… |
CVE-2024-28069 | High | 7.5 | 2024-03-16 | A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4 could allow an unauthenticated attacker to conduct an informat… |
CVE-2023-40266 | Critical | 9.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal. |
CVE-2023-40265 | High | 8.8 | 2024-02-08 | An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows authenticated remote code execution via file up… |
CVE-2023-39286 | Medium | 4.3 | 2023-09-14 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an unauthenticated attacker to perform a Cro… |
CVE-2023-39285 | Medium | 4.3 | 2023-09-14 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an unauthenticated attacker to perform a Cro… |
CVE-2023-39291 | Medium | 4.9 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated privileges… |
CVE-2023-39290 | Medium | 4.9 | 2023-08-25 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through R19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated pri… |
CVE-2023-39289 | High | 7.5 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an ac… |
CVE-2023-39288 | Medium | 5.5 | 2023-08-25 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2304.102 could allow an authenticated attacker with elevated priv… |
CVE-2023-39287 | Medium | 5.5 | 2023-08-25 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 SP3 (22.24.5800.0) could allow an authenticated attacker with elevated priv… |
CVE-2023-39293 | Critical | 9.8 | 2023-08-14 | A Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to execute… |
CVE-2023-39292 | Critical | 9.8 | 2023-08-14 | A SQL Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a malicious actor to access sensi… |
CVE-2023-32748 | Critical | 9.8 | 2023-08-14 | The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to… |
CVE-2023-31458 | Critical | 9.8 | 2023-05-24 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker wit… |
CVE-2023-25599 | High | 7.4 | 2023-05-24 | A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2, 22.24.1500.0 could allow an unauthenticated attacker to conduct a refl… |
CVE-2023-31460 | High | 7.2 | 2023-05-24 | A vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated attacker with intern… |
CVE-2023-31459 | High | 8.8 | 2023-05-24 | A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker wit… |
CVE-2023-31457 | Critical | 9.8 | 2023-05-24 | A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attac… |
CVE-2023-25598 | Medium | 6.1 | 2023-05-24 | A vulnerability in the conferencing component of Mitel MiVoice Connect through 19.3 SP2 and 20.x, 21.x, and 22.x through 22.24.1500.0 could allow an unauthenti… |
CVE-2023-25597 | Medium | 5.9 | 2023-04-14 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.6.2.9 could allow an unauthenticated attacker to download a shared file via a cra… |
CVE-2023-22854 | High | 7.5 | 2023-02-13 | The ccmweb component of Mitel MiContact Center Business server 9.2.2.0 through 9.4.1.0 could allow an unauthenticated attacker to download arbitrary files, due… |
CVE-2022-41326 | Critical | 9.8 | 2022-11-22 | The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authoriza… |
CVE-2022-41223 | Medium | 6.8 | 2022-11-22 | The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via cra… |
CVE-2022-40765 | Medium | 6.8 | 2022-11-22 | A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker with internal network… |
CVE-2022-36452 | Critical | 9.8 | 2022-10-25 | A vulnerability in the web conferencing component of Mitel MiCollab through 9.5.0.101 could allow an unauthenticated attacker to upload malicious files. A succ… |
CVE-2022-36454 | Medium | 6.5 | 2022-10-25 | A vulnerability in the MiCollab Client API of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters due to… |
CVE-2022-36453 | High | 8.8 | 2022-10-25 | A vulnerability in the MiCollab Client API of Mitel MiCollab 9.1.3 through 9.5.0.101 could allow an authenticated attacker to modify their profile parameters d… |
CVE-2022-36451 | High | 8.8 | 2022-10-25 | A vulnerability in the MiCollab Client server component of Mitel MiCollab through 9.5.0.101 could allow an authenticated attacker to conduct a Server-Side Requ… |
CVE-2022-31784 | Critical | 9.8 | 2022-06-17 | A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated… |
CVE-2022-29854 | Medium | 6.8 | 2022-05-13 | A vulnerability in Mitel 6900 Series IP (MiNet) phones excluding 6970, versions 1.8 (1.8.0.12) and earlier, could allow a unauthenticated attacker with physica… |
CVE-2022-29855 | Medium | 6.8 | 2022-05-11 | Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP pho… |
CVE-2022-29499 | Critical | 9.8 | 2022-04-26 | The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Applia… |
CVE-2022-26143 | Critical | 9.8 | 2022-03-10 | The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive i… |
CVE-2021-3352 | Critical | 9.1 | 2021-08-13 | The Software Development Kit in Mitel MiContact Center Business from 8.0.0.0 through 8.1.4.1 and 9.0.0.0 through 9.3.1.0 could allow an unauthenticated attacke… |
CVE-2021-37586 | Medium | 4.9 | 2021-08-13 | The PowerPlay Web component of Mitel Interaction Recording Multitenancy systems before 6.7 could allow a user (with Administrator rights) to replay a previousl… |
CVE-2021-32072 | Medium | 6.5 | 2021-08-13 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to get source code information (disclosing sensitive application dat… |
CVE-2021-32071 | Critical | 9.8 | 2021-08-13 | The MiCollab Client service in Mitel MiCollab before 9.3 could allow an unauthenticated user to gain system access due to improper access control. A successful… |
CVE-2021-32070 | Medium | 5.4 | 2021-08-13 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to perform a clickjacking attack due to an insecure header response… |
CVE-2021-32069 | Medium | 4.8 | 2021-08-13 | The AWV component of Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack due to improper TLS negotiation. A successful expl… |
CVE-2021-32068 | Low | 3.7 | 2021-08-13 | The AWV and MiCollab Client Service components in Mitel MiCollab before 9.3 could allow an attacker to perform a Man-In-the-Middle attack by sending multiple s… |
CVE-2021-32067 | Medium | 6.5 | 2021-08-13 | The MiCollab Client Service component in Mitel MiCollab before 9.3 could allow an attacker to view sensitive system information through an HTTP response due to… |
CVE-2021-27402 | Medium | 6.5 | 2021-08-13 | The SAS Admin portal of Mitel MiCollab before 9.2 FP2 could allow an unauthenticated attacker to access (view and modify) user data by injecting arbitrary dire… |
CVE-2021-27401 | Medium | 6.1 | 2021-08-13 | The Join Meeting page of Mitel MiCollab Web Client before 9.2 FP2 could allow an attacker to access (view and modify) user data by executing arbitrary code due… |
CVE-2021-26714 | Critical | 9.8 | 2021-03-29 | The Enterprise License Manager portal in Mitel MiContact Center Enterprise before 9.4 could allow a user to access restricted files and folders due to insuffic… |
CVE-2021-3176 | High | 8.0 | 2021-01-29 | The chat window of the Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.15 and 7.x before 7.1.2 could allow an attacker to gain access to use… |
CVE-2020-35547 | Critical | 9.1 | 2021-01-29 | A library index page in NuPoint Messenger in Mitel MiCollab before 9.2 FP1 could allow an unauthenticated attacker to gain access (view and modify) to user dat… |
CVE-2020-27640 | High | 8.1 | 2020-12-18 | The Bluetooth handset of Mitel MiVoice 6940 and 6930 MiNet phones with firmware before 1.5.3 could allow an unauthenticated attacker within Bluetooth range to… |
CVE-2020-27639 | High | 8.1 | 2020-12-18 | The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth… |
CVE-2020-27340 | Medium | 6.1 | 2020-12-18 | The online help portal of Mitel MiCollab before 9.2 could allow an attacker to redirect a user to an unauthorized website by executing malicious script due to… |
CVE-2020-27154 | High | 8.8 | 2020-12-18 | The chat window of Mitel BusinessCTI Enterprise (MBC-E) Client for Windows before 6.4.11 and 7.x before 7.0.3 could allow an attacker to gain access to user in… |
CVE-2020-25612 | Medium | 4.9 | 2020-12-18 | The NuPoint Messenger of Mitel MiCollab before 9.2 could allow an attacker with escalated privilege to access user files due to insufficient access control. Su… |
CVE-2020-25611 | Medium | 6.1 | 2020-12-18 | The AWV portal of Mitel MiCollab before 9.2 could allow an attacker to gain access to conference information by sending arbitrary code due to improper input va… |
CVE-2020-25610 | Medium | 5.3 | 2020-12-18 | The AWV component of Mitel MiCollab before 9.2 could allow an attacker to gain access to a web conference due to insufficient access control for conference cod… |
CVE-2020-25609 | Medium | 5.4 | 2020-12-18 | The NuPoint Messenger Portal of Mitel MiCollab before 9.2 could allow an authenticated attacker to execute arbitrary scripts due to insufficient input validati… |
CVE-2020-25608 | High | 7.2 | 2020-12-18 | The SAS portal of Mitel MiCollab before 9.2 could allow an attacker to access user credentials due to improper input validation, aka SQL Injection. |
CVE-2020-25606 | Medium | 6.1 | 2020-12-18 | The AWV component of Mitel MiCollab before 9.2 could allow an attacker to view system information by sending arbitrary code due to improper input validation, a… |
CVE-2020-24693 | Low | 3.3 | 2020-12-18 | The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow a local attacker to view system information due to insufficient output sanitiza… |
CVE-2020-28351 | Medium | 6.1 | 2020-11-09 | The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) att… |
CVE-2020-24692 | High | 7.1 | 2020-09-25 | The Ignite portal in Mitel MiContact Center Business before 9.3.0.0 could allow an attacker to execute arbitrary scripts due to insufficient input validation… |
CVE-2020-24595 | Medium | 5.3 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to retrieve sensitive information due to insufficient acc… |
CVE-2020-24594 | Critical | 9.6 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow an unauthenticated attacker to execute arbitrary scripts due to insufficient input validation, aka X… |
CVE-2020-24593 | High | 7.2 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow a remote attacker to conduct a SQL Injection attack and access user credentials due to improper inpu… |
CVE-2020-24592 | Medium | 5.3 | 2020-09-25 | Mitel MiCloud Management Portal before 6.1 SP5 could allow an attacker, by sending a crafted request, to view system information due to insufficient output san… |
CVE-2020-12456 | High | 8.8 | 2020-08-26 | A remote code execution vulnerability in Mitel MiVoice Connect Client before 214.100.1223.0 could allow an attacker to execute arbitrary code in the chat notif… |
CVE-2020-11797 | High | 7.5 | 2020-08-26 | An Authentication Bypass vulnerability in the Published Area of the web conferencing component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could… |
CVE-2020-13863 | High | 8.1 | 2020-08-26 | The SAS portal of Mitel MiCollab before 9.1.3 could allow an attacker to access user data by performing a header injection in HTTP responses, due to the improp… |
CVE-2020-13767 | Medium | 5.9 | 2020-08-26 | The Mitel MiCollab application before 9.1.332 for iOS could allow an unauthorized user to access restricted files and folders due to insufficient access contro… |
CVE-2020-13617 | High | 7.5 | 2020-08-26 | The Web UI component of Mitel MiVoice 6800 and 6900 series SIP Phones with firmware before 5.1.0.SP5 could allow an unauthenticated attacker to expose sensitiv… |
CVE-2020-11798 | Medium | 5.3 | 2020-06-10 | A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access… |
CVE-2020-12679 | Medium | 6.1 | 2020-05-07 | A reflected cross-site scripting (XSS) vulnerability in the Mitel ShoreTel Conference Web Application 19.50.1000.0 before MiVoice Connect 18.7 SP2 allows remot… |
CVE-2020-10377 | Critical | 9.8 | 2020-04-17 | A weak encryption vulnerability in Mitel MiVoice Connect Client before 214.100.1214.0 could allow an unauthenticated attacker to gain access to user credential… |