Skip to content
brandefense.io
Request A Demo
Vulnerability Intelligence

CVE-2024-41710

MediumExploitedPublic exploit

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to…

Published Aug 13, 2024 · Updated Oct 21, 2025 · Also known as TR-24-1229

Key Facts

Patch immediately
  • CVE-2024-41710 is a medium-severity vulnerability (CVSS 6.8 v3.1) affecting 6863i Sip Firmware (Mitel), 6865i Sip Firmware (Mitel), 6867i Sip Firmware (Mitel) and 12 more products.
  • It is exploited in the wild, listed in CISA KEV, Industry KEV feed, CIRCL KEV, ENISA EUVD since Jan 28, 2025. Public exploit code is available.
  • EPSS estimates a 42% probability of exploitation in the next 30 days.
  • Fixed versions are available, including 6863i Sip Firmware <=6.4.0.136, 6865i Sip Firmware <=6.4.0.136, 6867i Sip Firmware <=6.4.0.136.
  • Brandefense priority: patch immediately, because it is listed as exploited in the wild.

CVSS v3.1

6.8

CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

EPSS (30-day exploit likelihood)

42%

Higher than 98.6% of all scored CVEs

Exploited in the wild

Yes

4 catalog listings

Public exploit code

Available

Proof-of-concept or weaponized module

Get the full CVE-2024-41710 brief as a PDF

Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.

Description

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

Known-Exploited Catalog Listings

CatalogAddedRemediation dueRansomware use
CISA KEVFeb 12, 2025Mar 5, 2025Not reported
Industry KEV feedJan 28, 2025Mar 5, 2025Not reported
CIRCL KEVFeb 12, 2025Mar 5, 2025Not reported
ENISA EUVDFeb 12, 2025n/aNot reported

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Products

15 affected entries in total
ProductAffected versionsFixed in
6863i Sip FirmwareMitelSee advisory6.4.0.136
6865i Sip FirmwareMitelSee advisory6.4.0.136
6867i Sip FirmwareMitelSee advisory6.4.0.136
6869i Sip FirmwareMitelSee advisory6.4.0.136
6873i Sip FirmwareMitelSee advisory6.4.0.136
10 more affected products in the full CVE brief

Patched Releases

6863i Sip Firmware

<=6.4.0.136

6865i Sip Firmware

<=6.4.0.136

6867i Sip Firmware

<=6.4.0.136

6869i Sip Firmware

<=6.4.0.136

6873i Sip Firmware

<=6.4.0.136

6905 Sip Firmware

<=6.4.0.136

6910 Sip Firmware

<=6.4.0.136

6915 Sip Firmware

<=6.4.0.136

6920 Sip Firmware

<=6.4.0.136

6920w Sip Firmware

<=6.4.0.136

6930 Sip Firmware

<=6.4.0.136

6930w Sip Firmware

<=6.4.0.136

6940 Sip Firmware

<=6.4.0.136

6940w Sip Firmware

<=6.4.0.136

6970 Firmware

<=6.4.0.136

Timeline

  1. Publicly disclosed

    Aug 13, 2024

  2. Added to Industry KEV feed

    Jan 28, 2025

  3. Added to CISA KEV

    Feb 12, 2025

  4. Added to CIRCL KEV

    Feb 12, 2025

  5. Added to ENISA EUVD

    Feb 12, 2025

  6. Last updated

    Oct 21, 2025

Weakness Type

  • CWE-88 Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')

References

4 more references in the full CVE brief

FAQ

Common Questions.

Is CVE-2024-41710 Running On Your Attack Surface?

Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.

Request A Demo