CVE-2025-47188: Command Injection
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the phone, leading to disclosure or modification of sensitive configuration data or affecting device availability and operation.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2025-47188?
CVE-2025-47188 has a high severity due to the potential for command injection attacks by unauthenticated users.
How do I fix CVE-2025-47188?
To fix CVE-2025-47188, update the Mitel 6800 Series, 6900 Series, or 6900w Series SIP Phones and 6970 Conference Unit to version 6.4 SP5 or later.
Which devices are affected by CVE-2025-47188?
CVE-2025-47188 affects the Mitel 6800 Series, 6900 Series, 6900w Series SIP Phones, and the 6970 Conference Unit up to version 6.4 SP4.
What type of attack is associated with CVE-2025-47188?
CVE-2025-47188 is associated with command injection attacks that exploit insufficient parameter sanitization.
Can CVE-2025-47188 be exploited remotely?
Yes, CVE-2025-47188 can be exploited remotely by unauthenticated attackers.