CVE-2026-104807: Mitel MiVoice Office 400 stored Cross-Site Scripting
DigitalCanion has discovered a stored Cross-Site Scripting (XSS) vulnerability that allows an authenticated malicious user to inject persistent JavaScript or HTML content into the web application.
The specific flaw exists within the web portal listening on TCP port 443, under Configuration → Domains, specifically in the “Description” field. The application fails to properly validate or sanitize user-supplied input before storing and subsequently rendering the field.
By injecting malicious JavaScript into the Description field, an attacker can modify the content and behavior of the affected page when it is viewed by other users. This could allow an attacker to alter the page's appearance, display attacker-controlled content, or construct convincing phishing scenarios within the application's trusted web context.
Affected Software
Event History
Frequently Asked Questions
Who is exposed to this issue?
Users who view the Configuration → Domains page in the MiVoice Office 400 web portal may be exposed to attacker-controlled content. The portal is accessed over TCP port 443.
What does an attacker need to exploit it?
The attacker must be an authenticated user and must be able to enter content in the Description field under Configuration → Domains. The malicious content is stored and executes or affects the page when other users view it.
What is the likely impact of successful exploitation?
An attacker can alter the appearance or behavior of the affected page, show attacker-controlled content, and create phishing scenarios within the trusted web application context.