Read the docs
TI-2023-15072 Aliases CVE-2023-31458GHSA-xhfr-wh5m-r79w

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2…

Priority MEDIUM 51Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA.

Summary

A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00922 60th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
  • — Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*up to 22.24.1500.0VulnerableMitel
  • cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:* Versions up to 22.24.1500.0 Vulnerable ·Mitel

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-31458
  2. 2026-10-03 Alias added: GHSA-xhfr-wh5m-r79w

References

Advisory 2

  • TI-2022-11960 The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-19733 The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could… KEVCVSS 3.1MEDIUM 6.8
  • TI-2022-19391 A vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3… KEVCVSS 3.1MEDIUM 6.8
  • TI-2018-02664 Observable discrepancy in Intel Multiple CVSS 3.1MEDIUM 5.5
  • TI-2023-16014 The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0)… CVSS 3.1CRITICAL 9.8
  • TI-2023-15071 A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions… CVSS 3.1CRITICAL 9.8
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences