Command Injection Vulnerability in Mitel 6869i Devices

CVE-2024-37569

Summary

A security flaw has been identified in Mitel 6869i devices running versions up to 4.5.0.41 and 5.x up to 5.0.0.1018. This vulnerability allows an authenticated user to exploit a command injection through improperly sanitized input in the hostname parameter of the provis.html endpoint. Since the input is executed as part of shell commands during system boot, attackers can execute arbitrary commands in the system's root context by injecting shell metacharacters into the hostname. This serious oversight in input validation could lead to remote code execution, granting unauthorized control over the device.

References