Critical Authentication Bypass and Command Injection Fixed in Mitel MiVoice MX-ONE PBX Platform
Mitel addressed three significant vulnerabilities in its MiVoice MX-ONE enterprise telephony platform, including a critical authentication bypass rated CVSS 9.4. These flaws affect the Provisioning Manager and Service Node Manager components and can be chained to substantially escalate impact, potentially allowing unauthenticated internal attackers to gain administrative access and execute operating system commands. Although no public exploits or attacks have been reported yet, these vulnerabilities pose a serious risk to call routing and telephony service integrity, given Mitel products' known targeting in the wild. Hotfixes 8.2 SP0 HF5 and 8.2 SP1 HF2 resolve these issues, with version 8.3 planned to include the fixes. Until patching, mitigating access to management interfaces is recommended.
Entenda a falha
A vulnerabilidade
Mitel fixed three flaws in MiVoice MX-ONE, tracked by internal IDs because CVEs are requested but not yet assigned. The most severe is MTLVULN-1860 (CVSS 9.4), an authentication bypass in Service Node Manager: an unauthenticated attacker on the internal LAN can log in as admin and change PBX routing and service configuration. MTLVULN-1859 (CVSS 8.2) is a command injection in Service Node Manager that lets an admin run OS commands with the management service account's privileges. MTLVULN-1858 (CVSS 6.5) is weak authorization in Provisioning Manager that lets any logged-in user read system configuration. Affected: 8.0 (8.0.0.33) through 8.2 SP1 (8.2.1.0.14); fixed by hotfixes 8.2 SP0 HF5 and 8.2 SP1 HF2, and by 8.3 once released.
Como funciona
An attacker with access to the internal network reaches the Service Node Manager management interface. The login check does not properly enforce authentication, so the attacker is treated as an administrator without credentials. As admin, they can view and change telephony routing and service configuration. Service Node Manager also accepts some parameters without cleaning them, so those values end up being run as operating system commands under the management service account. Separately, Provisioning Manager serves configuration data to any authenticated user without checking their privilege level.
Por que é vulnerável
According to Mitel's descriptions, the causes are improper authentication controls in Service Node Manager, missing sanitization of some parameters in the same component, and weak authorization in Provisioning Manager. Chained, the bypass removes the need for credentials and the injection turns admin access into command execution. The articles do not explain why the flaws went unnoticed or detail what the hotfixes change in the code.
Onde está
The flaws are in the Service Node Manager and Provisioning Manager components of MiVoice MX-ONE, described in Mitel advisory MISA-2026-0011; no file or function is named.
Como foi descoberta
The articles do not say who found the flaws or how. Mitel disclosed them in security advisory MISA-2026-0011 and a knowledge base article, tracking them as MTLVULN-1858, 1859 and 1860 and saying a CVE identifier has been requested but not yet assigned. Mitel has not reported any attacks against these flaws. Versions that have reached end of support were not assessed.
Explicação gerada por IA a partir da matéria e dos artigos, em 12/11/2026 23:15.
Linha do tempo
-
Critical Authentication Bypass and Command Injection Fixed in Mitel MiVoice MX-ONE PBX Platform
ler a análise desta fonte ocultar
Mitel addressed three significant vulnerabilities in its MiVoice MX-ONE enterprise telephony platform, including a critical authentication bypass rated CVSS 9.4. These flaws affect the Provisioning Manager and Service Node Manager components and can be chained to substantially escalate impact, potentially allowing unauthenticated internal attackers to gain administrative access and execute operating system commands. Although no public exploits or attacks have been reported yet, these vulnerabilities pose a serious risk to call routing and telephony service integrity, given Mitel products' known targeting in the wild. Hotfixes 8.2 SP0 HF5 and 8.2 SP1 HF2 resolve these issues, with version 8.3 planned to include the fixes. Until patching, mitigating access to management interfaces is recommended.