← Vulnerability feed

Vulnerability record · CVE-2023-31457 · published 24 May 2023

CVE-2023-31457: Mitel mivoice connect vulnerability

Mitel · Mivoice Connect

A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.

9.8 CVSS 3.1 Critical EPSS 0.99% · top 39.1%
9.8CVSS 3.1 base score
0.99%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.mitel.com/support/security-advisories Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0004 Vendor Advisory
https://www.mitel.com/support/security-advisories Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0004 Vendor Advisory

Track CVE-2023-31457 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-29499Mitel MiVoice Connect Service Appliance input validation RCEThe Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 fails to properly validate input, allowing remote code execution. The appli…KEVEPSS 55%analysed6.8CVE-2022-41223Mitel MiVoice Connect Director database code injectionThe Director database component of MiVoice Connect through 19.3 (22.22.6100.0) fails to sufficiently restrict database data types, allowing crafted d…KEVEPSS 11%analysed6.8CVE-2022-40765Mitel MiVoice Connect Edge Gateway command injectionMitel MiVoice Connect through 19.3 (22.22.6100.0) contains a command-injection flaw in the Edge Gateway component caused by insufficient restriction …KEVEPSS 11%analysed9.8CVE-2023-32748Mitel mivoice connect incorrect authorization vulnerabilityThe Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network…EPSS 0.90%9.8CVE-2023-31458Mitel mivoice connect vulnerabilityA vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated at…EPSS 0.92%9.8CVE-2020-10211Mitel mivoice connect improper input validation vulnerabilityA remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to exe…EPSS 3.0%8.8CVE-2023-31459Mitel mivoice connect weak password recovery vulnerabilityA vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated at…EPSS 0.39%7.5CVE-2023-39289Mitel mivoice connect information exposure vulnerabilityA vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to con…EPSS 0.59%

Source: NIST National Vulnerability Database (record CVE-2023-31457), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.