Mitel SIP phones: argument injection during boot process (CVE-2024-41710) #shorts

Summary

In today's podcast, we're diving into CVE-2024-41710, a critical vulnerability affecting Mitel SIP phones. Discovered by Akamai's Security Intelligence Response Team, this vulnerability has become a significant concern due to its exploitation by the Aquabotv3 botnet, a new variant of the infamous Mirai malware. Exploiting this vulnerability can lead to severe consequences, including unauthorized command execution, which poses a threat to businesses relying on these telecommunication systems.

Product Details

CVE-2024-41710 impacts multiple series of Mitel SIP phones, including the 6800 Series, 6900 Series, 6900w Series, and the 6970 Conference Unit. These devices, especially through their earlier versions up to R6.4.0.HF1 (R6.4.0.136), lack sufficient parameter sanitization during the boot process, leading to potential security breaches.

Vulnerability Type Summary

This particular vulnerability is categorized as an argument injection attack. It's primarily concerning since it allows authenticated attackers with administrative privileges to exploit insufficient parameter validation. This flaw can lead to unauthorized command executions, potentially disrupting corporate communication systems using the affected Mitel devices.

Details of the Vulnerability

The core issue with CVE-2024-41710 is the inadequate parameter sanitization during the boot process of the affected Mitel SIP phones. This oversight permits authenticated attackers with administrative access to conduct argument injection attacks. Once exploited, the vulnerability allows attackers to execute arbitrary commands within the system's context, giving them significant control. Notably, the Aquabotv3 botnet has been leveraging this vulnerability to conduct Distributed Denial of Service (DDoS) attacks, further amplifying its threat level.

Conclusion

In conclusion, CVE-2024-41710 poses a substantial risk to networks relying on Mitel SIP phones, especially given its exploitation by modern botnets like Aquabotv3. Organizations using these devices must upgrade to newer firmware versions that address this security flaw. Staying informed and proactive in patching known vulnerabilities remains a cornerstone of maintaining robust cybersecurity defenses.

This chain involves the following actors

This following systems are involved

Attack entry point

Remediation actions

Exploitation actions

• https://www.mitel.com/support/security-advisories
• https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md
• https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019