CVE-2024-37569

View on CVE.org

Published Jun 9, 2024 CVSS 3.1 · 8.3 High EPSS 3.2% KEV · Not listed

Description

An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter.

Affected Products

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

n/a

n/a

affected

Version	Status	Constraints
`n/a`	affected	—

Configuration 1 [-]

AND

OR	cpe:2.3:o:mitel:6869i_sip_firmware::::::::
	cpe:2.3:o:mitel:6869i_sip_firmware::::::::

cpe:2.3:h:mitel:6869i_sip:-:*:*:*:*:*:*:*

No data.

No data available yet.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

No advisories available

Metrics

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploit prediction score: 3.2% (3.199% probability within 30 days)

Exploitation poc

Automatable no

Technical Impact total

References

Link	Providers
https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py
https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis
https://www.youtube.com/watch?v=I9TQqfP5qzM

History

No history.

Subscriptions

Mitel 6869i Firmware 6869i Sip 6869i Sip Firmware

Weaknesses

CWE-77

Sources

CVE record Updated: Aug 2, 2024, 3:57 AM

Status: PUBLISHED
Assigner: mitre
Published: Jun 9, 2024, 12:00 AM
Updated: Aug 2, 2024, 3:57 AM
Reserved: Jun 9, 2024, 12:00 AM

View source JSON

Vulnrichment Updated: Aug 2, 2024, 3:57 AM

Updated: Aug 2, 2024, 3:57 AM

NVD Updated: Jun 17, 2026, 7:38 AM

Status: Modified
Published: Jun 9, 2024, 8:15 PM
Modified: Jun 17, 2026, 7:38 AM

View source JSON

Red Hat No data

No data.

OpenCVE enrichment No data

No data.

{"dataType": "CVE_RECORD", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2024-37569", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T03:57:39.561Z", "dateReserved": "2024-06-09T00:00:00.000Z", "datePublished": "2024-06-09T00:00:00.000Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-09T19:38:03.567Z"}, "descriptions": [{"lang": "en", "value": "An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis"}, {"url": "https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py"}, {"url": "https://www.youtube.com/watch?v=I9TQqfP5qzM"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-77", "lang": "en", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "affected": [{"vendor": "mitel", "product": "6869i_firmware", "cpes": ["cpe:2.3:a:mitel:6869i_firmware:4.5.0.41:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "versions": [{"version": "4.5.0.41", "status": "affected"}, {"version": "5.0.0.1018", "status": "affected"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-06-10T12:43:09.374978Z", "id": "CVE-2024-37569", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-10T12:46:21.387Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:57:39.561Z"}, "title": "CVE Program Container", "references": [{"url": "https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis", "tags": ["x_transferred"]}, {"url": "https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py", "tags": ["x_transferred"]}, {"url": "https://www.youtube.com/watch?v=I9TQqfP5qzM", "tags": ["x_transferred"]}]}]}, "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis", "tags": ["x_transferred"]}, {"url": "https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py", "tags": ["x_transferred"]}, {"url": "https://www.youtube.com/watch?v=I9TQqfP5qzM", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T03:57:39.561Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.3, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "LOW", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2024-37569", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-06-10T12:43:09.374978Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:mitel:6869i_firmware:4.5.0.41:*:*:*:*:*:*:*"], "vendor": "mitel", "product": "6869i_firmware", "versions": [{"status": "affected", "version": "4.5.0.41"}, {"status": "affected", "version": "5.0.0.1018"}], "defaultStatus": "unknown"}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-10T12:46:15.556Z"}}], "cna": {"affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "references": [{"url": "https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis"}, {"url": "https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py"}, {"url": "https://www.youtube.com/watch?v=I9TQqfP5qzM"}], "descriptions": [{"lang": "en", "value": "An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "n/a"}]}], "providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2024-06-09T19:38:03.567Z"}}}, "cveMetadata": {"cveId": "CVE-2024-37569", "state": "PUBLISHED", "dateUpdated": "2024-08-02T03:57:39.561Z", "dateReserved": "2024-06-09T00:00:00.000Z", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "datePublished": "2024-06-09T00:00:00.000Z", "assignerShortName": "mitre"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "source": "cve@mitre.org"}, {"affectedData": [{"cpes": ["cpe:2.3:a:mitel:6869i_firmware:4.5.0.41:*:*:*:*:*:*:*"], "defaultStatus": "unknown", "product": "6869i_firmware", "vendor": "mitel", "versions": [{"status": "affected", "version": "4.5.0.41"}, {"status": "affected", "version": "5.0.0.1018"}]}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:mitel:6869i_sip_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "E8D691F3-B302-475B-9527-09D091318240", "versionEndIncluding": "4.5.0.41", "vulnerable": true}, {"criteria": "cpe:2.3:o:mitel:6869i_sip_firmware:*:*:*:*:*:*:*:*", "matchCriteriaId": "4D0EC3DA-18DD-48AC-803C-1EB9E8281F9D", "versionEndIncluding": "5.0.0.1018", "versionStartIncluding": "5.0.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:h:mitel:6869i_sip:-:*:*:*:*:*:*:*", "matchCriteriaId": "654554ED-253C-4928-92D0-92EADF5F4768", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter."}, {"lang": "es", "value": "Se descubri\u00f3 un problema en dispositivos Mitel 6869i hasta 4.5.0.41 y 5.x hasta 5.0.0.1018. Existe una vulnerabilidad de inyecci\u00f3n de comando en el par\u00e1metro de nombre de host tomado por el endpoint provis.html. El endpoint provis.html no realiza ninguna sanitizaci\u00f3n en el par\u00e1metro de nombre de host (enviado por un usuario autenticado), que posteriormente se escribe en el disco. Durante el arranque, el par\u00e1metro de nombre de host se ejecuta como parte de una serie de comandos de shell. Los atacantes pueden lograr la ejecuci\u00f3n remota de c\u00f3digo en el contexto ra\u00edz colocando metacaracteres del shell en el par\u00e1metro de nombre de host."}], "id": "CVE-2024-37569", "lastModified": "2026-06-17T07:38:37.807", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 8.3, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.5, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2024-37569", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2024-06-10T12:43:09.374978Z", "version": "2.0.3"}}]}, "published": "2024-06-09T20:15:09.377", "references": [{"source": "cve@mitre.org", "tags": ["Product"], "url": "https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py"}, {"source": "cve@mitre.org", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis"}, {"source": "cve@mitre.org", "tags": ["Exploit"], "url": "https://www.youtube.com/watch?v=I9TQqfP5qzM"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Product"], "url": "https://github.com/kwburns/CVE/blob/main/Mitel/5.0.0.1018/code/exploit-provis.py"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Third Party Advisory"], "url": "https://github.com/kwburns/CVE/tree/main/Mitel/5.0.0.1018#authenticated-remote-command-execution-provis"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://www.youtube.com/watch?v=I9TQqfP5qzM"}], "sourceIdentifier": "cve@mitre.org", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-77"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-77"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}