Mitel - RCE (CVE-2025-47188)

CVE-2025-47188 is a command injection vulnerability in Mitel 6800, 6900, 6900w Series SIP Phones, and the 6970 Conference Unit, allowing unauthenticated attackers to execute arbitrary commands due to improper parameter sanitization. Exploitation of this flaw could lead to unauthorized disclosure or modification of sensitive configuration data, potentially impacting device operation and security.

CrowdSec has been tracking this vulnerability and its exploits since 29th of December 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2025-47188 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. In addition, according to the CrowdSec network, attack volume against CVE-2025-47188 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the /cgi-bin/webconfig endpoint with parameters like page=upload_ringtone and action=submit to upload malicious files and inject OS commands, targeting Mitel SIP phones and conference units.