← Vulnerability feed

Vulnerability record · CVE-2023-39289 · published 25 August 2023

CVE-2023-39289: Mitel mivoice connect information exposure vulnerability

Mitel · Mivoice Connect

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker to access system information.

7.5 CVSS 3.1 High EPSS 0.59% · top 53.9% CWE-200 · Information exposure
7.5CVSS 3.1 base score
0.59%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
4References
17 Jun 2026Last modified by NVD

Description

A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an unauthenticated attacker to conduct an account enumeration attack due to improper configuration. A successful exploit could allow an attacker to access system information.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
https://www.mitel.com/support/security-advisories Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0011 Vendor Advisory
https://www.mitel.com/support/security-advisories Vendor Advisory
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-23-0011 Vendor Advisory

Track CVE-2023-39289 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2022-29499Mitel MiVoice Connect Service Appliance input validation RCEThe Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 fails to properly validate input, allowing remote code execution. The appli…KEVEPSS 55%analysed6.8CVE-2022-41223Mitel MiVoice Connect Director database code injectionThe Director database component of MiVoice Connect through 19.3 (22.22.6100.0) fails to sufficiently restrict database data types, allowing crafted d…KEVEPSS 11%analysed6.8CVE-2022-40765Mitel MiVoice Connect Edge Gateway command injectionMitel MiVoice Connect through 19.3 (22.22.6100.0) contains a command-injection flaw in the Edge Gateway component caused by insufficient restriction …KEVEPSS 11%analysed9.8CVE-2023-32748Mitel mivoice connect incorrect authorization vulnerabilityThe Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network…EPSS 0.90%9.8CVE-2023-31458Mitel mivoice connect vulnerabilityA vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated at…EPSS 0.92%9.8CVE-2023-31457Mitel mivoice connect vulnerabilityA vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthentic…EPSS 0.99%9.8CVE-2020-10211Mitel mivoice connect improper input validation vulnerabilityA remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an unauthenticated remote attacker to exe…EPSS 3.0%8.8CVE-2023-31459Mitel mivoice connect weak password recovery vulnerabilityA vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier could allow an unauthenticated at…EPSS 0.39%

Source: NIST National Vulnerability Database (record CVE-2023-39289), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.