CVE-2018-12901

Severity: medium (CVSS 6.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-10-23 · updated 2026-06-17
Weakness: CWE-79

Description

A vulnerability in the conferencing component of Mitel ST 14.2, versions GA29 (19.49.9400.0) and earlier, could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient validation for the signin.php page. A successful exploit could allow an attacker to execute arbitrary scripts.

Affected products

Mitel St Firmware: before 19.49.9400.0 — fixed in 19.49.9400.0

How to fix

Upgrade to a fixed version: Mitel St Firmware 19.49.9400.0. Check the vendor advisory for mitigations.

References

https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0007
https://www.mitel.com/en-ca/support/security-advisories/mitel-product-security-advisory-18-0007

Get alerted when CVE-2018-12901 or the next vulnerability affects your stack