Mitel SIP Phones Argument Injection Vulnerability (CVE-2024-41710)
Severity: high · Patch status: unknown · Since 2025-02-12 · CVE-2024-41710
Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, contain an argument injection vulnerability due to insufficient parameter sanitization during the boot process. Successful exploitation may allow an attacker to execute arbitrary commands within the context of the system. CISA added CVE-2024-41710 to its Known Exploited Vulnerabilities catalog on Feb 12, 2025, which means attackers are exploiting it in the wild.
What to do
- Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- US federal agencies must remediate by Mar 5, 2025 (BOD 22-01); treat that as the outer limit.
Sources
All live incidents on Threat Watch
