CVE-2020-27639: The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth devic...

Summary

The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit cou...

What to do

Update mitel 6873i_sip_firmware to version 5.1.0 or later.
Update mitel 6930_sip_firmware to version 5.1.0 or later.
Update mitel 6940_sip_firmware to version 5.1.0 or later.

Affected software

Vendor	Product	Affected versions
mitel	6873i_sip_firmware	< 5.1.0 5.1.0 `cpe:2.3:o:mitel:6873i_sip_firmware::::::::`
mitel	6930_sip_firmware	< 5.1.0 5.1.0 `cpe:2.3:o:mitel:6930_sip_firmware::::::::`
mitel	6940_sip_firmware	< 5.1.0 5.1.0 `cpe:2.3:o:mitel:6940_sip_firmware::::::::`

Original advisory text

The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth devic...

The Bluetooth handset of Mitel MiVoice 6873i, 6930, and 6940 SIP phones with firmware before 5.1.0.SP6 could allow an unauthenticated attacker within Bluetooth range to pair a rogue Bluetooth device when a phone handset loses connection, due to an improper pairing mechanism. A successful exploit could allow an attacker to eavesdrop on conversations.

References

https://www.mitel.com/support/security-advisories Vendor Advisory