Mitel vulnerabilities8 known to be exploited.
Mitel has 121 published vulnerabilities across 129 products in our catalogue. 8 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Micollab, with 37. If you run Mitel software, patch the exploited flaws first.
The most recent Mitel flaw added to the known-exploited list is CVE-2024-41710, on 12 February 2025. We keep watching the known-exploited list.
Which Mitel products have the most vulnerabilities?
Micollab leads with 37 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Mitel vulnerabilities are being exploited?
8 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.2Mitel SIP Phones Argument Injection Vulnerability
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process.
- 9.1Mitel MiCollab Path Traversal Vulnerability
Mitel MiCollab contains a path traversal vulnerability that could allow an attacker to gain unauthorized and unauthenticated access.
- 2.7Mitel MiCollab Path Traversal Vulnerability
Mitel MiCollab contains a path traversal vulnerability that could allow an authenticated attacker with administrative privileges to read local files within the system due to insufficient input sanitization.
- 6.8Mitel MiVoice Connect Code Injection Vulnerability
The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.
- 6.8Mitel MiVoice Connect Command Injection Vulnerability
The Mitel Edge Gateway component of MiVoice Connect allows an authenticated attacker with internal network access to execute commands within the context of the system.
- 9.8Mitel MiVoice Connect Data Validation Vulnerability
The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.
- 7.5OpenSSL Information Disclosure Vulnerability
The TLS and DTLS implementations in OpenSSL do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information.
- 9.8MiCollab, MiVoice Business Express Access Control Vulnerability
A vulnerability has been identified in MiCollab and MiVoice Business Express that may allow a malicious actor to gain unauthorized access to sensitive information and services, cause performance degradations or a...
Which Mitel flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- >99%
The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly handle Heartbeat Extension packets, which allows remote attackers to obtain sensitive information from process memory via...
- 97%
A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an unauthenticated attacker to conduct a path traversal attack, due to insufficient input...
- 87%
The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service (performance...
- 61%CVE-2018-3639Medium
Systems with microprocessors utilizing speculative execution and speculative execution of memory reads before the addresses of all prior memory writes are known may allow unauthorized disclosure of information to an...
- 55%
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation.
- 49%CVE-2020-11798Medium
A Directory Traversal vulnerability in the web conference component of Mitel MiCollab AWV before 8.1.2.4 and 9.x before 9.1.3 could allow an attacker to access arbitrary files from restricted directories of the...
- 38%
Mitel MiCollab through 9.8 SP2 could allow an authenticated attacker with administrative privilege to conduct a local file read, due to insufficient input sanitization.
- 19%CVE-2018-5782Critical
A vulnerability in the conferencing component of Mitel Connect ONSITE, versions R1711-PREM and earlier, and Mitel ST 14.2, release GA28 and earlier, could allow an unauthenticated attacker to inject PHP code using...
- 16%CVE-2020-28351Medium
The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack (via the PATH_INFO to index.php) due to insufficient...
All Mitel products we track.
67 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Micollabmicollab37 vulnerabilities57 versions
- Mivoice Connectmivoice_connect25 vulnerabilities32 versions
- Micontact Center Businessmicontact_center_business10 vulnerabilities35 versions
- Connect Onsiteconnect_onsite7 vulnerabilities4 versions
- Micollab Audio, Web & Video Conferencingmicollab_audio\,_web_\&_video_conferencing6 vulnerabilities18 versions
- St14.2st14.26 vulnerabilities1 version
- Micloud Management Portalmicloud_management_portal5 vulnerabilities3 versions
- 6869i SIP Firmware6869i_sip_firmware4 vulnerabilities8 versions
- St 14.2st_14.24 vulnerabilities1 version
- 6873i SIP Firmware6873i_sip_firmware3 vulnerabilities7 versions
- 6930 SIP Firmware6930_sip_firmware3 vulnerabilities7 versions
- 6940 SIP Firmware6940_sip_firmware3 vulnerabilities7 versions
- Cmg Suitecmg_suite3 vulnerabilities1 version
- Mivoice Business Expressmivoice_business_express3 vulnerabilities7 versions
- Mivoice Office 400mivoice_office_4003 vulnerabilities3 versions
- 6865i SIP Firmware6865i_sip_firmware2 vulnerabilities4 versions
- 6867i SIP Firmware6867i_sip_firmware2 vulnerabilities5 versions
- 6920 Firmware6920_firmware2 vulnerabilities3 versions
- 6930 Firmware6930_firmware2 vulnerabilities3 versions
- 6940 Firmware6940_firmware2 vulnerabilities3 versions
- 6970 Firmware6970_firmware2 vulnerabilities4 versions
- Businesscti Enterprisebusinesscti_enterprise2 vulnerabilities10 versions
- Mivoice Connect Clientmivoice_connect_client2 vulnerabilities2 versions
- Mivoice Office 400 SMB Controller Firmwaremivoice_office_400_smb_controller_firmware2 vulnerabilities1 version
This directory lists the 67 Mitel products with at least one tracked version, of 129 in our catalogue.
Running Mitel? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system.
- Matched to
- 6970 on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 121 published vulnerabilities across 129 products and 327 versions from Mitel. The most recent Mitel flaw added to the known-exploited list is CVE-2024-41710, on 12 February 2025.
8 Mitel vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2024-41710, CVE-2024-41713 and CVE-2024-55550. The full list is on this page.
Micollab, with 37 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a Precursor Intelligence account and track the Mitel products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.