Do Son 
TL;DR
Mitel has fixed three MiVoice MX-ONE vulnerabilities in its enterprise phone platform, including a critical authentication bypass rated CVSS 9.4. The flaws sit in the Provisioning Manager and Service Node Manager components. Mitel warns that chaining them “can significantly amplify their impact, potentially resulting in a critical severity.”
An attacker on the internal network could bypass login, gain admin access and then run operating system commands on MiVoice MX-ONE. Hotfixes 8.2 SP0 HF5 and 8.2 SP1 HF2 fix all three flaws. Apply them now, or move to version 8.3 when it ships.
Why It Matters
MX-ONE is a PBX platform for enterprise telephony, so a takeover can let attackers reroute calls or disrupt service. In addition, Mitel products are a known target. CISA’s Known Exploited Vulnerabilities catalog already lists seven Mitel flaws, covering MiCollab, MiVoice Connect and SIP phones.
So far, Mitel has not reported any attacks against these MiVoice MX-ONE vulnerabilities, and no public exploit has surfaced. CVE IDs are also pending. For now, Mitel tracks the bugs by internal IDs, noting that “a CVE identifier has been requested but is not yet assigned.”
How the Attack Works
Authentication bypass (MTLVULN-1860, CVSS 9.4)
Improper authentication controls in Service Node Manager let an unauthenticated attacker on the LAN log in as an admin. From there, the attacker can “view and modify PBX telephony routing and service configuration.”
Command injection (MTLVULN-1859, CVSS 8.2)
Service Node Manager also fails to clean some parameters. An admin, or an attacker who gained admin access through the bypass, can run operating system commands with the management service account’s privileges. According to Mitel, this “could enable an attacker to view sensitive configuration data, alter system settings, or disrupt telephony management services.”
Unauthorized access (MTLVULN-1858, CVSS 6.5)
Meanwhile, weak authorization in Provisioning Manager lets any logged-in user, at any privilege level, read system configuration data.
The chain
Put together, the bypass removes the need for credentials, and the injection turns admin access into command execution. However, every step requires internal LAN access.
Affected Versions
- MiVoice MX-ONE 8.0 (8.0.0.33) through 8.2 SP1 (8.2.1.0.14)
Versions that have reached end of support were not assessed.
Patch and Mitigation
Upgrade to MX-ONE 8.2 SP0 or 8.2 SP1, then apply the MX-ONE PM/SNM hotfix HF5 or HF2, or later. Version 8.3 will include the fixes once released. Details are in Mitel security advisory MISA-2026-0011 and the Mitel knowledge base article on the MX-ONE security update. Until you patch, restrict access to the Provisioning Manager and Service Node Manager interfaces to trusted admin hosts. Fixing these MiVoice MX-ONE vulnerabilities quickly protects call routing across the organization.
Support Our Threat Intelligence
Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!
Buy Me a Coffee
