CVE-2019-18863 Weak cryptography in n/a
Weak SRTP key implementation allows man-in-the-middle attackers to intercept sensitive call data on Mitel SIP phones.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-18863?
CVE-2019-18863 is a medium-severity vulnerability in n/a, published on 2 Mar 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. A successful exploit may allow the attacker to intercept sensitive information.
Weakness: CWE-326
Which versions are affected by CVE-2019-18863?
It affects 8 products.
Products include Mitel 6863i Firmware, Mitel 6865i Firmware, Mitel 6867i Firmware, Mitel 6869i Firmware, Mitel 6873i Firmware, Mitel 6920 Firmware and 2 more.
How do I fix CVE-2019-18863?
No fix has been published for CVE-2019-18863 yet. Limit exposure of the affected software until one is available.
Is CVE-2019-18863 being exploited?
There is no known exploitation of CVE-2019-18863 in the wild and no public exploit code.
Sources
Also known as GHSA-68jq-f8j4-qrjp.