Read the docs
TI-2026-67661 Aliases CVE-2026-104811GHSA-g7mp-v763-325c

File upload flaw in Mitel MiVoice Office 400 allows code execution

Priority LOW 38CWE-20Published · Updated

Key facts

Attack vector
Local
Privileges required
High
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

Mitel MiVoice Office 400 from 11.0.96.0 fails to validate file types in its Music on Hold upload in the web portal on TCP port 443 (CWE-434). A remote attacker can upload a malicious shared object instead of a WAV file, so attacker-controlled code loads and runs in the affected process, potentially compromising the underlying Linux system. Authentication may be required.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00213 11th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
MitelMitel MiVoice Office 40011.0.96.0—No fix listedCNA
  • Mitel MiVoice Office 400 VendorMitel Affected 11.0.96.0 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Mitel MiVoice Office 400.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-104811
  2. 2026-10-05 Alias added: GHSA-g7mp-v763-325c

References

Other 1

  • TI-2022-11960 The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote… KEVCVSS 3.1CRITICAL 9.8
  • TI-2022-09601 The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice… KEVCVSS 3.1CRITICAL 9.8
  • TI-2024-27773 A vulnerability in the NuPoint Unified Messaging (NPM) component of Mitel MiCollab… KEVCVSS 3.1CRITICAL 9.1
  • TI-2024-27770 A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones… KEVCVSS 3.1HIGH 7.2
  • TI-2014-00154 The (1) TLS and (2) DTLS implementations in OpenSSL 1.0.1 before 1.0.1g do not properly… KEVCVSS 3.1HIGH 7.5
  • TI-2022-19733 The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could… KEVCVSS 3.1MEDIUM 6.8
See all 141 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences