CVE-2024-28066 Hardcoded credentials in n/a
Attackers can gain root access to Unify CP IP Phones using hardcoded credentials, leading to full device compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-28066?
CVE-2024-28066 is a high-severity vulnerability in n/a, published on 8 Apr 2024. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).
Which versions are affected by CVE-2024-28066?
It affects 14 products.
Products include Mitel 6905 Firmware, Mitel 6910 Firmware, Mitel 6915 Firmware, Mitel 6920w Firmware, Mitel 6930w Firmware, Mitel 6940w Firmware and 8 more.
How do I fix CVE-2024-28066?
No fix has been published for CVE-2024-28066 yet. Limit exposure of the affected software until one is available.
Is CVE-2024-28066 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-28066 exists.
Sources
Also known as GHSA-pxfw-cxx3-vxv8.