Cyber Resilience

CVE-2024-37570

HighPublic PoCRCE

Published: 09 June 2024

Published
09 June 2024
Modified
21 November 2024
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0041 62.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2024-37570 is a high-severity Command Injection (CWE-77) vulnerability in Mitel 6869I Sip Firmware. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Unix Shell (T1059.004); ranked in the top 38.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability details

On Mitel 6869i 4.5.0.41 devices, the Manual Firmware Update (upgrade.html) page does not perform sanitization on the username and path parameters (sent by an authenticated user) before appending flags to the busybox ftpget command. This leads to $() command execution.

CWE(s)
CWE-77

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1059.004 Unix Shell Execution
Adversaries may abuse Unix shell commands and scripts for execution.
attack.mitre.org →
T1210 Exploitation of Remote Services Lateral Movement
Adversaries may exploit remote services to gain unauthorized access to internal systems once inside of a network.
attack.mitre.org →
Why these techniques?

Authenticated command injection in the firmware update web page enables remote Unix shell command execution (busybox ftpget) via unsanitized parameters (T1059.004) and exploitation of the remote web service (T1210).

Affected Assets

mitel
6869i sip firmware
4.5.0.41

Mitigating Controls

No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.

References