CVE-2020-27639

Severity: high (CVSS 8.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-18 · updated 2026-06-17

Description

The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations.

Affected products

Mitel 6873I Sip Firmware: before 5.1.0; 5.1.0, 5.1.0-sp1, 5.1.0-sp2, 5.1.0-sp3, 5.1.0-sp4, 5.1.0-sp5 — fixed in 5.1.0
Mitel 6930 Sip Firmware: before 5.1.0; 5.1.0, 5.1.0-sp1, 5.1.0-sp2, 5.1.0-sp3, 5.1.0-sp4, 5.1.0-sp5 — fixed in 5.1.0
Mitel 6940 Sip Firmware: before 5.1.0; 5.1.0, 5.1.0-sp1, 5.1.0-sp2, 5.1.0-sp3, 5.1.0-sp4, 5.1.0-sp5 — fixed in 5.1.0

How to fix

Upgrade to a fixed version: Mitel 6873I Sip Firmware 5.1.0; Mitel 6930 Sip Firmware 5.1.0; Mitel 6940 Sip Firmware 5.1.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2020-27639 or the next vulnerability affects your stack