# CVE-2025-47188: Mitel - RCE

> Live exploitation tracking for CVE-2025-47188 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-47188

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 6.5
- **Public exploit available:** Yes
- **Affected products:** Mitel
- **Weaknesses:** CWE-77 (Improper Neutralization of Special Elements used in a Command ('Command Injection'))
- **Tags:** web_application

## Description

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones through 6.4 SP4 (R6.4.0.4006), and the 6970 Conference Unit through 6.4 SP4 (R6.4.0.4006) or version V1 R0.1.0, could allow an unauthenticated attacker to conduct a command injection attack due to insufficient parameter sanitization. A successful exploit could allow an attacker to execute arbitrary commands within the context of the phone, leading to disclosure or modification of sensitive configuration data or affecting device availability and operation.

## CrowdSec analysis

[CVE-2025-47188](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-47188) is a command injection vulnerability in Mitel 6800, 6900, 6900w Series SIP Phones, and the 6970 Conference Unit, allowing unauthenticated attackers to execute arbitrary commands due to improper parameter sanitization. Exploitation of this flaw could lead to unauthorized disclosure or modification of sensitive configuration data, potentially impacting device operation and security.

CrowdSec has been tracking this vulnerability and its exploits since 29th of December 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2025-47188 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations.
In addition, according to the CrowdSec network, attack volume against CVE-2025-47188 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.

Attackers exploit the `/cgi-bin/webconfig` endpoint with parameters like `page=upload_ringtone` and `action=submit` to upload malicious files and inject OS commands, targeting Mitel SIP phones and conference units.

## Timeline

- 2025-08-07: CVE Published. CVE-2025-47188 is published to NVD.
- 2025-12-29: Rule Released. CrowdSec releases a rule to detect CVE-2025-47188 exploitation attempts against the CrowdSec Network.
- 2026-01-08: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-47188 for the first time.

## References

- https://www.mitel.com/support/security-advisories
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0004
- https://github.com/projectdiscovery/nuclei-templates/blob/main/network/cves/2025/CVE-2025-47188.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-47188) follows observed exploitation activity for CVE-2025-47188. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.