Critical Flaws in Mitel SIP Phones Open the Door to Remote Attacks
Cybersecurity experts have uncovered two high-impact security flaws in Mitel’s SIP-based communication devices that could allow remote attackers to take control of affected systems without needing valid credentials.
The most critical of the two, tracked as CVE-2025-47188, carries a CVSS score of 9.8 and impacts a range of models, including the 6800 Series, 6900 Series, 6900w Series, and the 6970 Conference Unit. This vulnerability arises from improper handling of input parameters in the device’s web interface, which can be exploited to inject system-level commands.
Unlike many threats that rely on compromised credentials, this flaw is unauthenticated, allowing adversaries to execute arbitrary commands simply by sending specially crafted requests—potentially exposing configuration data, altering device behavior, or completely disabling the hardware.
Exploitation Mechanics
At the heart of the issue is a failure to properly sanitize web interface inputs. Attackers can manipulate parameters using command separators such as ; or |, effectively appending their own instructions to legitimate system operations. For instance:
sql
GET /config?parameter=value;malicious_command HTTP/1.1
Host: [target_device]
Once exploited, this grants attackers privileged access within the device’s operating environment—opening up avenues for data theft, system tampering, or persistent access.
Additional Threat: Unauthenticated File Upload (CVE-2025-47187)
In addition to the command injection flaw, a separate vulnerability (CVE-2025-47187, CVSS 5.3) enables attackers to upload arbitrary .wav files to Mitel phones, which can saturate the internal storage and interfere with regular operation. While this vulnerability is less severe on its own, it introduces an additional method for disrupting communications infrastructure.
Attack Surface Considerations
Both vulnerabilities require network-level access to target devices. While this limits exposure to some extent, many SIP phones are deployed within internal networks that may already be vulnerable due to lateral movement or poor segmentation practices—making this a significant threat vector in enterprise environments.
Affected Models and Firmware
The flaws affect all firmware versions up to R6.4.0.SP4 across the following models:
- Mitel 6800 Series
- Mitel 6900 Series
- Mitel 6900w Series
- Mitel 6970 Conference Phone
Remediation Steps
Mitel has released a firmware update (R6.4.0.SP5) on May 7, 2025, addressing both vulnerabilities. Customers are urged to update as soon as possible.
For organizations that cannot immediately patch, Mitel recommends:
- Network segmentation to isolate SIP phones from broader enterprise infrastructure
- Restricting access to trusted IP ranges only
- Reviewing mitigation techniques outlined in Mitel KB SO8496
These vulnerabilities were responsibly disclosed by Marc Bollhalder of InfoGuard Labs, reinforcing the importance of transparent, coordinated research in strengthening telecom security.
