CVE-2026-104810 in MiVoice Office 400
Summary
by MITRE • 10/05/2026
This vulnerability allows remote attackers to delete sensitive files on vulnerable installations of Mitel MiVoice Office 400. Authentication is required to exploit this vulnerability.
The specific flaw exists within the web portal listening on TCP port 443, under Maintenance → File Management → File Browser, which is affected by a directory traversal vulnerability. By exploiting this vulnerability, an authenticated attacker can access and delete files outside of the intended directory, including files belonging to the Mitel application and the underlying Linux system. Deleting critical system or application files can result in a denial-of-service condition affecting the underlying system.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/05/2026
The identified security flaw resides within the web-based management interface of Mitel MiVoice Office 400 systems, specifically targeting the File Management module accessible via TCP port 443. This component is designed to allow authorized administrators to browse and manage files on the underlying Linux operating system through a graphical user interface labeled as File Browser. The vulnerability stems from an insufficient validation mechanism when processing file path inputs within this web portal. Instead of strictly confining operations to the designated application directory, the software fails to properly sanitize or canonicalize user-supplied input that specifies target file locations. This deficiency allows for a classic directory traversal attack vector where special character sequences are injected into the request parameters to manipulate the intended file system navigation logic.
By exploiting this path manipulation weakness, an authenticated attacker can bypass access controls and traverse up the directory hierarchy using standard relative path notation such as dot-dot-slash sequences. Once outside the restricted scope of the application's working directory, the attacker gains the ability to interact with arbitrary files on the host operating system. The specific impact highlighted in reports involves the capability to delete sensitive or critical files belonging to both the Mitel MiVoice Office 400 application itself and core components of the underlying Linux infrastructure. This level of access effectively grants the adversary significant control over the integrity of the server environment, as they are no longer limited to modifying only those resources explicitly intended for administrative management through the web interface.
The operational impact of this vulnerability is primarily centered on system availability and service continuity. The ability to delete critical application files can lead directly to a denial-of-service condition where the VoIP services managed by MiVoice Office 400 cease to function correctly or become entirely unavailable. Furthermore, if core Linux system libraries or configuration files are removed, it may result in a complete failure of the underlying operating system, requiring manual intervention and restoration from backups to recover functionality. This represents a severe threat to organizations relying on this platform for mission-critical communications infrastructure, as the loss of service can disrupt business operations significantly. The requirement for authentication does not mitigate the severity given that compromised administrative credentials are a common vector for initial access in enterprise environments.
From a classification perspective, this vulnerability aligns with CWE-22 Improper Limitation of a Pathname to a Restricted Directory and CWE-73 External Control of File Name or Path. In terms of tactical mapping within the MITRE ATT&CK framework, this behavior corresponds to T1083 File and Directory Discovery followed by T1485 Data Destruction. The exploitation chain typically involves an attacker first gaining valid credentials through phishing, credential stuffing, or other authentication bypass techniques, then leveraging these privileges to navigate the vulnerable web interface and execute destructive file operations remotely without needing local shell access.
Mitigation strategies should focus on both immediate remediation and long-term architectural improvements. Vendors must release patches that enforce strict input validation and canonicalization of all file path inputs within the File Browser module. Implementing a whitelist approach for allowed directories ensures that only predefined paths are accessible, effectively neutralizing traversal attempts regardless of the characters used in the request. Additionally, organizations should apply the principle of least privilege by restricting web service accounts to minimal necessary filesystem permissions, ensuring that even if an attacker exploits this flaw, they cannot delete critical system files due to OS-level permission denials. Network segmentation and strict access control lists for port 443 can also limit exposure to only trusted management networks, reducing the attack surface available to potential adversaries seeking to exploit authenticated vulnerabilities within internal infrastructure components.