IT SBIT Services
Schneeberger
DEEN
CVE tracker

Mitel MiVoice Office 400: Arbitrary file write via backup restoration

CVE-2026-104805High 8.5

← All vulnerabilities

Summary

The backup restoration function of Mitel MiVoice Office 400 does not properly validate paths, file types, integrity or authenticity of files in a restored TGZ archive, and it performs no file-signature check before extraction. An attacker with write access to the configured backup repository, such as a backup SFTP server, can supply a crafted backup that places arbitrary files on the underlying Linux system, which may lead to code execution with root privileges. Backup passwords are not enforced, which further weakens protection. The CVSS 4.0 base score is 8.5 (High).

Affected

  • Mitel MiVoice Office 400, version 11.0.96.0 (Linux)
  • Other versions: Unknown.

Fixed in

Unknown. No fixed version has been confirmed.

Workaround

Unknown. No official workaround from the vendor has been confirmed.

Practical measures:

  • Restrict and monitor write access to the backup SFTP or other repository; use dedicated accounts and keys.
  • Enable backup encryption and passwords.
  • Limit who can trigger a restore and verify backups before restoring.
  • Place the PBX management and backup systems on a segregated network.

Exploitation

  • No evidence of exploitation in the wild was found.
  • No public proof of concept was found.
  • The CVSS vector includes E:P (proof-of-concept maturity).
  • CISA SSVC: not automatable, total technical impact.

Our recommendation

  • Check whether MiVoice Office 400 is in use and whether version 11.0.96.0 is deployed.
  • Ask your Mitel partner or check Mitel's security advisories for a fix and confirm the status.
  • Restrict write access to backup repositories, enforce backup passwords and monitor access logs.
  • Restrict restore rights and check backups before restoring.
  • Segregate PBX management and backup systems from general networks.
  • Review related Mitel CVEs published on the same day together with this one.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:30.

Original description (NVD)

DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration. The specific flaw exists within the backup restoration mechanism, which fails to properly validate the paths, file types, integrity, and authenticity of files contained within a restored TGZ archive. The application does not perform file-signature verification before extracting the archive, allowing a specially crafted backup to contain attacker-controlled files. An attacker with access to the backup SFTP or other configured repository can therefore provide a malicious TGZ archive that, when restored by the system, may place arbitrary files on the underlying Linux system. Depending on the location and permissions of the extracted files, this behavior can potentially be leveraged to achieve arbitrary code execution with root privileges and compromise the underlying virtual machine. The absence of enforced backup passwords further reduces the protection provided by the backup mechanism and may facilitate unauthorized access to the repository.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed