Urgent Security Advisory: Mitel Exposed Critical Vulnerability in Unify OpenScape 4000
Mitel, a global leader in business communications, has issued an urgent security advisory regarding a critical vulnerability discovered in its Unify OpenScape 4000 communication system and related components. This vulnerability, categorized as a command injection flaw, could allow unauthenticated attackers to execute arbitrary commands on affected systems, potentially leading to unauthorized access, data breaches, and system disruptions.
The vulnerability affects both the Platform Webservice and Assistant components of Unify OpenScape 4000, as well as the Unify OpenScape 4000 Manager. The Common Vulnerability Scoring System (CVSS) has assigned a critical severity rating of 9.8, underscoring the urgency for immediate action.
Vulnerability Details:
- Platform Webservice: Insufficient parameter sanitization allows attackers to inject malicious commands through the platform’s web interface.
- Assistant: Similar to the Platform Webservice, inadequate input validation leaves the Assistant vulnerable to command injection attacks.
Impact:
Successful exploitation of these vulnerabilities could result in:
- Unauthorized access to sensitive data
- Modification or deletion of critical system files
- Disruption of communication services
- Installation of malware or other malicious payloads
Affected Products:
- Unify OpenScape 4000: Versions V11 R0.22 and earlier
- Unify OpenScape 4000 Manager: Versions V10 R1.34, V10 R1.42, and V11 R0.22
- Unify OpenScape 4000 Assistant: Versions V11 R0.22 and earlier
Mitigation:
Mitel strongly recommends that all users of affected products apply the available patches immediately. Hotfixes [1,2] have been released for both Unify OpenScape 4000 and Unify OpenScape 4000 Manager, addressing the vulnerabilities in specific versions.
Temporary Workarounds:
In the interim, Mitel has provided temporary workarounds for Unify OpenScape 4000 Manager V10 and V11, including enabling restricted access to the Platform Portal and SSH and activating secure mode on the platform.
