Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).

CVE-2024-28066 · published 2 years ago
Summary

In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).

What to do
  • Update mitel 6940w_firmware to version 1.11.3.0 or later.
  • Update mitel 6930w_firmware to version 1.11.3.0 or later.
  • Update mitel 6920w_firmware to version 1.11.3.0 or later.
  • Update mitel 6970_firmware to version 1.11.3.0 or later.
  • Update mitel 6915_firmware to version 1.11.3.0 or later.
  • Update mitel 6910_firmware to version 1.11.3.0 or later.
  • Update mitel 6905_firmware to version 1.11.3.0 or later.
  • Update mitel openscape_cp710_firmware to version 1.11.3.0 or later.
  • Update mitel openscape_cp410_firmware to version 1.11.3.0 or later.
  • Update mitel openscape_cp210_firmware to version 1.11.3.0 or later.
  • Update mitel openscape_cp110_firmware to version 1.11.3.0 or later.
  • Update mitel openscape_cpx10_firmware to version 1.11.3.0 or later.
  • Update mitel openscape_dect_firmware to version 1.11.3.0 or later.
  • Update mitel 700d_dect_firmware to version 1.11.3.0 or later.
Affected software
VendorProductAffected versions
mitel 6940w_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:6940w_firmware:*:*:*:*:*:*:*:*
mitel 6930w_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:6930w_firmware:*:*:*:*:*:*:*:*
mitel 6920w_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:6920w_firmware:*:*:*:*:*:*:*:*
mitel 6970_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:6970_firmware:*:*:*:*:*:*:*:*
mitel 6915_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:6915_firmware:*:*:*:*:*:*:*:*
mitel 6910_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:6910_firmware:*:*:*:*:*:*:*:*
mitel 6905_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:6905_firmware:*:*:*:*:*:*:*:*
mitel openscape_cp710_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:openscape_cp710_firmware:*:*:*:*:*:*:*:*
mitel openscape_cp410_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:openscape_cp410_firmware:*:*:*:*:*:*:*:*
mitel openscape_cp210_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:openscape_cp210_firmware:*:*:*:*:*:*:*:*
mitel openscape_cp110_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:openscape_cp110_firmware:*:*:*:*:*:*:*:*
mitel openscape_cpx10_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:openscape_cpx10_firmware:*:*:*:*:*:*:*:*
mitel openscape_dect_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:openscape_dect_firmware:*:*:*:*:*:*:*:*
mitel 700d_dect_firmware >= 1.10.4.3, < 1.11.3.0
cpe:2.3:o:mitel:700d_dect_firmware:*:*:*:*:*:*:*:*
Original advisory text
In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).
In Unify CP IP Phone firmware 1.10.4.3, Weak Credentials are used (a hardcoded root password).
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
8.8 High
Exploitation
<1% chance of attack within 30 days
Type
CWE-259Use of Hard-coded Password
CWE-1391Use of Weak Credentials
Timeline
Published8 Apr 2024
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2024-28066 · NVD
Track software like this
Free during beta