Unauthenticated Command Injection Vulnerability

CVE-2024-35314

Summary

A command injection vulnerability in both the Desktop Client of Mitel MiCollab (up to version 9.7.1.110) and the MiVoice Business Solution Virtual Instance (MiVB SVI) (up to version 1.0.0.25) has been identified, allowing an attacker to exploit insufficient parameter sanitization. Although exploitation requires user interaction, successful execution of this vulnerability could enable the attacker to run arbitrary scripts on the affected systems. Users are advised to implement mitigations and apply security patches as needed to protect against potential exploitation.

References