Mitel MiVoice Office 400: Code execution via unrestricted file upload in Music on Hold
Summary
The Music on Hold function of the web portal in Mitel MiVoice Office 400 does not properly validate uploaded files. An authenticated user with high privileges can upload a shared object (.so) file disguised as a WAV file, and the component loads and executes it. Because the appliance runs on a Linux base, this can lead to full compromise of the underlying system.
Affected
- Mitel MiVoice Office 400 11.0.96.0 (per CVE record mirror)
- Other versions: Unknown.
Fixed in
Unknown.
Workaround
- No vendor workaround found.
- Restrict access to the web portal to administrative networks or a VPN.
- Limit the accounts that can access Music on Hold settings and enforce strong passwords and MFA where available.
Exploitation
- No public proof of concept found.
- No known active exploitation found.
- The CVSS vector includes E:P (proof-of-concept maturity), as assessed by the CNA.
Our recommendation
- Confirm whether any system runs MiVoice Office 400 11.0.96.0.
- Do not expose the web portal to the internet; restrict it to admin networks or VPN.
- Review Music on Hold storage for files that are not genuine WAV audio, especially .so files, and consult Mitel or your partner before changing files on production systems.
- Monitor the portal for unusual uploads and unexpected processes.
- Apply Mitel's fix once published and check Mitel's security advisories regularly.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Finder advisory (DigitalCanion, Mitel) digitalcanion.com
- CVE record mirror (NCSC.ch) cve.threatint.com
- Record summary and CVSS (strix.ai) www.strix.ai
- MiVoice Office 400 Security Guidelines (Mitel) www.mitel.com
- Hol.org CVE entry hol.org
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 12:53.
Original description (NVD)
DigitalCanion SA has discovered a vulnerability that allows remote attackers to execute arbitrary code on affected installations of the product. Authentication may be required to exploit this vulnerability. The specific flaw exists within the Configuration → Services → Music on Hold functionality of the web portal listening on TCP port 443. The application is intended to allow users to upload WAV audio files but fails to properly validate the uploaded file type. An attacker can exploit this behavior to upload a malicious shared object (.so) instead of a WAV file. When the uploaded file is subsequently processed by the affected component, attacker-controlled code is loaded and executed in the context of the affected process. This can result in remote code execution and potentially full compromise of the underlying Linux system.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.