Command Execution Vulnerability in Mitel 6869i 4.5.0.41 Devices via Manual Firmware Update Page

CVE-2024-37570

Summary

Mitel 6869i devices running version 4.5.0.41 are affected by a security vulnerability stemming from a lack of input sanitization on the Manual Firmware Update page. An authenticated user can exploit this flaw by manipulating the username and path parameters sent to the system. This unsanitized input is passed directly to the busybox ftpget command, enabling the potential for arbitrary command execution within the device's environment.

References