CVE-2024-37570: Command Injection
On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an authenticated user) before appending flags to the busybox ftpget command. This leads to $() command execution.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-37570?
CVE-2024-37570 is classified as a critical vulnerability due to the potential for authenticated remote command execution.
How do I fix CVE-2024-37570?
To fix CVE-2024-37570, update the Mitel 6869i SIP Firmware to a version that properly sanitizes input on the Manual Firmware Update page.
Who is affected by CVE-2024-37570?
CVE-2024-37570 affects Mitel 6869i devices running firmware version 4.5.0.41.
What kind of attack can be executed through CVE-2024-37570?
CVE-2024-37570 allows for command injection attacks due to inadequate input sanitization.
Is user authentication required for exploiting CVE-2024-37570?
Yes, an authenticated user is required to exploit CVE-2024-37570 through the Manual Firmware Update page.