CVE-2026-104810
Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability
Published Oct 5, 2026
CVSS 4.0 · 8.4 High
EPSS < 1%
KEV · Not listed
Description
This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability.
The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management → File Browser, which is affected by a directory traversal vulnerability. By exploiting this vulnerability, an authenticated attacker can access and delete files outside of the intended directory, including files belonging to the Mitel application and the underlying Linux system. Deleting critical system or application files can result in a denial-of-service condition affecting the underlying system.
The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management → File Browser, which is affected by a directory traversal vulnerability. By exploiting this vulnerability, an authenticated attacker can access and delete files outside of the intended directory, including files belonging to the Mitel application and the underlying Linux system. Deleting critical system or application files can result in a denial-of-service condition affecting the underlying system.
Affected Products
-
CVE record
-
NVD configurations
No data
-
Red Hat packages
No data
-
OpenCVE enrichment
No data
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Mitel | Mitel MiVoice Office 400 | unknown |
|
No data.
No data.
No data available yet.
Remediation
Tracking
Advisories
Metrics
Attack Vector Local
Attack Complexity Low
Privileges Required High
Attack Requirements None
User Interaction None
Vulnerable System Confidentiality Impact High
Vulnerable System Integrity Impact High
Vulnerable System Availability Impact High
Subsequent System Confidentiality Impact High
Subsequent System Integrity Impact High
Subsequent System Availability Impact High
No CVSS v3.1
No CVSS v3.0
No CVSS v2
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.384% probability within 30 days)
Exploitation none
Automatable no
Technical Impact total
References
History
Oct 5, 2026 1:30 PM
Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Oct 5, 2026 9:00 AM
Description updated. Title updated. Weaknesses updated. Added references. Scoring metrics updated
View changes
| Type | Values Removed | Values Added |
|---|---|---|
| Description | This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management → File Browser, which is affected by a directory traversal vulnerability. By exploiting this vulnerability, an authenticated attacker can access and delete files outside of the intended directory, including files belonging to the Mitel application and the underlying Linux system. Deleting critical system or application files can result in a denial-of-service condition affecting the underlying system. | |
| Title | Mitel MiVoice Office 400 File Management File Browser path traversal vulnerability | |
| Weaknesses | CWE-31 | |
| References |
| |
| Metrics |
cvssV4_0
|
Subscriptions
No data.
Weaknesses
