Mitel MiVoice Office 400: Path traversal in File Browser allows file deletion
Summary
Mitel MiVoice Office 400 version 11.0.96.0 contains a path traversal flaw (CWE-31) in the File Browser of the web portal on TCP 443. An authenticated attacker with administrator-level access can delete files outside the intended directory, including Mitel application files and Linux system files. Deleting critical files can cause a denial-of-service condition. The CVSS vector rates the attack vector as local, while the description refers to remote attackers; this discrepancy is unresolved.
Affected
- Mitel MiVoice Office 400 version 11.0.96.0 (Linux), as listed by DigitalCanion
- Other versions: Unknown.
Fixed in
Unknown.
Workaround
- No vendor workaround known.
- Restrict access to the web portal on TCP 443 to a management network or VPN.
- Limit and review administrator accounts.
- Monitor the portal logs for file-management activity.
- These are general hardening measures based on the attack path, not vendor guidance.
Exploitation
- No known exploitation reported in the sources; the vulnerability is not listed as known exploited (KEV: No).
- No public exploit found in the sources checked. The DigitalCanion advisory describes the flaw publicly.
- The exploit maturity value E:P is the CNA's value and is not confirmed.
Our recommendation
- Check whether the web portal on TCP 443 is reachable from the internet and restrict it to a management network or VPN if it is.
- Confirm the installed version. If it is 11.0.96.0, treat the system as affected and ask Mitel or your reseller for a fix.
- Audit administrator accounts, remove unused or shared accounts and enable MFA where supported.
- Take and verify backups before making changes.
- Recheck the Mitel advisory and the NVD and NCSC records, as the status is still pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- DigitalCanion Security Research digitalcanion.com
- NCSC Switzerland CVE records www.bacs.admin.ch
- Threatint CVE-2026-104810 cve.threatint.com
- HOL Guard CVE-2026-104810 hol.org
- Strix CVE-2026-104810 www.strix.ai
- OffSeq CVE-2026-104810 radar.offseq.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:53.
Original description (NVD)
This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability. The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management → File Browser, which is affected by a directory traversal vulnerability. By exploiting this vulnerability, an authenticated attacker can access and delete files outside of the intended directory, including files belonging to the Mitel application and the underlying Linux system. Deleting critical system or application files can result in a denial-of-service condition affecting the underlying system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.