CVE-2019-18863

Severity: medium (CVSS 5.9 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-03-02 · updated 2026-06-17
Weakness: CWE-326

Description

A key length vulnerability in the implementation of the SRTP 128-bit key on Mitel 6800 and 6900 SIP series phones, versions 5.1.0.2051 SP2 and earlier, could allow an attacker to launch a man-in-the-middle attack when SRTP is used in a call. A successful exploit may allow the attacker to intercept sensitive information.

Affected products

Mitel 6863I Firmware: before 5.1.0.2051; 5.1.0.2051, 5.1.0.2051-sp2_hf2 — fixed in 5.1.0.2051
Mitel 6865I Firmware: before 5.1.0.2051; 5.1.0.2051, 5.1.0.2051-sp2_hf2 — fixed in 5.1.0.2051
Mitel 6867I Firmware: before 5.1.0.2051; 5.1.0.2051, 5.1.0.2051-sp2_hf2 — fixed in 5.1.0.2051
Mitel 6869I Firmware: before 5.1.0.2051; 5.1.0.2051, 5.1.0.2051-sp2_hf2 — fixed in 5.1.0.2051
Mitel 6873I Firmware: before 5.1.0.2051; 5.1.0.2051, 5.1.0.2051-sp2_hf2 — fixed in 5.1.0.2051
Mitel 6920 Firmware: before 5.1.0.2051; 5.1.0.2051, 5.1.0.2051-sp2_hf2 — fixed in 5.1.0.2051
Mitel 6930 Firmware: before 5.1.0.2051; 5.1.0.2051, 5.1.0.2051-sp2_hf2 — fixed in 5.1.0.2051
Mitel 6940 Firmware: before 5.1.0.2051; 5.1.0.2051, 5.1.0.2051-sp2_hf2 — fixed in 5.1.0.2051

How to fix

Upgrade to a fixed version: Mitel 6863I Firmware 5.1.0.2051; Mitel 6865I Firmware 5.1.0.2051; Mitel 6867I Firmware 5.1.0.2051; Mitel 6869I Firmware 5.1.0.2051; Mitel 6873I Firmware 5.1.0.2051; Mitel 6920 Firmware 5.1.0.2051; Mitel 6930 Firmware 5.1.0.2051; Mitel 6940 Firmware 5.1.0.2051. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2019-18863 or the next vulnerability affects your stack