CVE-2024-41710

CVE-2024-41710 is an argument injection vulnerability (CWE-88) affecting Mitel 6800 Series, 6900 Series, and 6900w Series SIP phones, including the 6970 Conference Unit, caused by insufficient sanitization of parameters processed during the device's boot process. An attacker who can supply crafted arguments to the boot process can inject and execute arbitrary commands within the context of the phone's system. Organizations deploying these enterprise desk phones are affected; the available data does not specify affected or fixed firmware version ranges. CISA added the flaw to the Known Exploited Vulnerabilities catalog on 2025-02-12, confirming exploitation in the wild, though no public proof-of-concept is known and any ransomware association is unconfirmed. EPSS assigns a 41.6% probability of exploitation within the next 30 days (99th percentile), so remediation should be treated as urgent.

What to do: Update affected 6800/6900/6900w series phones to the fixed firmware per Mitel's security advisory and reboot the phones so they boot with patched firmware, since the flaw is in the boot process; if fixed firmware is unavailable, apply Mitel's mitigations or discontinue use per the CISA KEV required action. Check whether phone management or provisioning interfaces are reachable from untrusted networks and restrict that access. Given KEV-listed exploitation and a 99th-percentile EPSS score, prioritize remediation, and note federal agencies are required to act under the KEV deadline.