PT-2026-104771
CVE-2026-104806
·
Published
2026-10-05
·
Updated
2026-10-05
Description by
CVSS 4.0
5.4
MediumMetricsAV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:A/V:D/RE:L/U:Amber
Name of the Vulnerable Software and Affected Versions
Mitel MiVoice Office 400 (affected versions not specified)
Description
A path traversal flaw exists in the Maintenance → System Logs functionality of the web management portal on TCP port 443. The application does not properly validate user-supplied file paths, enabling an attacker to manipulate the path and traverse the directory structure. This allows unauthorized access to and download of files outside the intended system logs directory, which may include sensitive system and application files.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Found an issue in the description? Have something to add? Feel free to write us 👾