CVE-2024-36446: mivoice mx-one — Fix

Description

The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successful exploit could allow an attacker to bypass the authorization schema.

Is your site exposed to CVE-2024-36446?

Run a free security scan — no signup, results in seconds.

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions
mitel	mivoice_mx-one	< 7.6
mitel	mivoice_mx-one	All
mitel	mivoice_mx-one	All

References

Advisories & Patches

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0017

Frequently Asked Questions

What is CVE-2024-36446? +

The provisioning manager component of Mitel MiVoice MX-ONE through 7.6 SP1 could allow an authenticated attacker to conduct an authentication bypass attack due to improper access control. A successful exploit could allow an attacker to bypass the authorization schema. It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2024-36446? +

CVE-2024-36446 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching.

What products are affected by CVE-2024-36446? +

CVE-2024-36446 affects products from mitel, specifically: mivoice_mx-one. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2024-36446? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-35286 9.8

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a SQL injection …

CVE-2024-35314 9.8

A vulnerability in the Desktop Client of Mitel MiCollab through 9.7.1.110, and MiVoice Business Solution Virtual Instance (MiVB SVI) 1.0.0.25, …

CVE-2024-35285 9.8

A vulnerability in NuPoint Messenger (NPM) of Mitel MiCollab through 9.8.0.33 allows an unauthenticated attacker to conduct a command injection …

CVE-2023-40266 9.8

An issue was discovered in Atos Unify OpenScape Xpressions WebAssistant V7 before V7R1 FR5 HF42 P911. It allows path traversal.

CVE-2024-47223 9.4

A vulnerability in the AWV (Audio, Web and Video Conferencing) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could …

CVE-2024-41713 9.1

A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab through 9.8 SP1 FP2 (9.8.1.201) could allow an …

CVE-2024-36446