CVE-2023-31459 Auth bypass in n/a

What is CVE-2023-31459?

CVE-2023-31459 is a high-severity authentication bypass vulnerability in n/a, published on 24 May 2023. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated attacker with internal network access to authenticate with administrative privileges, because the initial installation does not enforce a password change. A successful exploit could allow an attacker to make arbitrary configuration changes and execute arbitrary commands.

Weakness: CWE-640

Which versions are affected by CVE-2023-31459?

It affects 1 product.

Products include Mitel Mivoice Connect.

How do I fix CVE-2023-31459?

No fix has been published for CVE-2023-31459 yet. Limit exposure of the affected software until one is available.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2023-31459 being exploited?

There is no known exploitation of CVE-2023-31459 in the wild and no public exploit code.

Other vulnerabilities in n/a

• CVE-2022-29499 Mitel MiVoice Connect Data Validation Exploited Critical 9.8
• CVE-2022-40765 Mitel MiVoice Connect Command Injection Exploited Medium 6.8
• CVE-2022-41223 Mitel MiVoice Connect Code Injection Exploited Medium 6.8
• CVE-2023-32748 Missing authorization in n/a Critical 9.8
• CVE-2023-31457 Missing authorization in n/a Critical 9.8

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-m4w7-g56p-3vc4.