CVE & CISA-KEV Catalog

CVE-2022-29855

MEDIUM

6.8

CVSS v3

Description

Mitel 6800 and 6900 Series SIP phone devices through 2022-04-27 have "undocumented functionality." A vulnerability in Mitel 6800 Series and 6900 Series SIP phones excluding 6970, versions 5.1 SP8 (5.1.0.8016) and earlier, and 6.0 (6.0.0.368) through 6.1 HF4 (6.1.0.165), could allow a unauthenticated attacker with physical access to the phone to gain root access due to insufficient access control for test functionality during system startup. A successful exploit could allow access to sensitive information and code execution.

How to fix

Remediation Available

6865i sip firmwareNVD

Affected:>= 6.0.0.368, < 6.1.0.171Fixed in:6.1.0.171CVE-2022-29855derived from NVD

6867i sip firmwareNVD

Affected:>= 6.0.0.368, < 6.1.0.171Fixed in:6.1.0.171CVE-2022-29855derived from NVD

6869i sip firmwareNVD

Affected:>= 6.0.0.368, < 6.1.0.171Fixed in:6.1.0.171CVE-2022-29855derived from NVD

6873i sip firmwareNVD

Affected:>= 6.0.0.368, < 6.1.0.171Fixed in:6.1.0.171CVE-2022-29855derived from NVD

6930 sip firmwareNVD

Affected:>= 6.0.0.368, < 6.1.0.171Fixed in:6.1.0.171CVE-2022-29855derived from NVD

6940 sip firmwareNVD

Affected:>= 6.0.0.368, < 6.1.0.171Fixed in:6.1.0.171CVE-2022-29855derived from NVD

Remediation is compiled from vendor and distribution security advisories. Always confirm against the linked source for your exact version and platform.

CVSS v3 Vector

Exploitability

Attack VectorPhysical

Attack ComplexityLow

Privileges RequiredNone

User InteractionNone

ScopeUnchanged

Impact

ConfidentialityHigh

IntegrityHigh

AvailabilityHigh

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploit Intelligence

0.74%probability of exploitation in 30 days

50thpercentile

Moderate risk: more likely to be exploited than 50% of all known CVEs.

References

Exploit2

Vendor Advisory2

Third-Party Advisory1

syss.de

Embed a live status badge for CVE-2022-29855

Markdown

[![CVE-2022-29855](https://tridentstack.com/cve/badge/CVE-2022-29855.svg)](https://tridentstack.com/cve/CVE-2022-29855)

HTML

<a href="https://tridentstack.com/cve/CVE-2022-29855"><img src="https://tridentstack.com/cve/badge/CVE-2022-29855.svg" alt="CVE-2022-29855"></a>

Find and fix vulnerabilities across your fleet

TridentStack Control continuously scans your Windows, macOS, and Linux fleet for known vulnerabilities, prioritizes them by severity and active exploitation, and patches them automatically.

This product uses NVD data but is not endorsed or certified by the NVD. EPSS scores courtesy of FIRST.org (https://www.first.org/epss). Source: CISA KEV Catalog. Data as of 2024-11-21.