CVE-2024-28066

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-04-08 · updated 2026-06-17
Weakness: CWE-259

Description

In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).

Affected products

Mitel 6905 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel 6910 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel 6915 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel 6920W Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel 6930W Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel 6940W Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel 6970 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel 700D Dect Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel Openscape Cp110 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel Openscape Cp210 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel Openscape Cp410 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel Openscape Cp710 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel Openscape Cpx10 Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0
Mitel Openscape Dect Firmware: from 1.10.4.3 before 1.11.3.0 — fixed in 1.11.3.0

How to fix

Upgrade to a fixed version: Mitel 6905 Firmware 1.11.3.0; Mitel 6910 Firmware 1.11.3.0; Mitel 6915 Firmware 1.11.3.0; Mitel 6920W Firmware 1.11.3.0; Mitel 6930W Firmware 1.11.3.0; Mitel 6940W Firmware 1.11.3.0; Mitel 6970 Firmware 1.11.3.0; Mitel 700D Dect Firmware 1.11.3.0; Mitel Openscape Cp110 Firmware 1.11.3.0; Mitel Openscape Cp210 Firmware 1.11.3.0; Mitel Openscape Cp410 Firmware 1.11.3.0; Mitel Openscape Cp710 Firmware 1.11.3.0. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2024-28066 or the next vulnerability affects your stack