Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
🛡️
CISA KEV · ACTIVELY EXPLOITED
MEDIUM severity

CVE-2024-41710 — 6863i Sip Firmware

MEDIUM

CVE-2024-41710 is a medium-severity (CVSS 6.8) CWE-88 vulnerability in mitel 6863i sip firmware. It is in CISA's Known Exploited Vulnerabilities catalog (added 2025-02-12) — treat it as actively exploited and patch now. No vendor fix is recorded yet; mitigation options are listed below.

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated…

Published
Updated
Affected
15 products
Patched
See advisory
Exploits
None indexed
Exploitation data as of Oct 24, 2026 · OSV.dev, NVD, CISA KEV, FIRST.org (EPSS)

Exploitation Status

Actively exploited in the wild

  • Confirmed by CISA's Known Exploited Vulnerabilities catalog on 2025-02-12. Federal agencies were required to remediate by 2025-03-05.
  • A successful exploit gives an attacker total control of the affected component, not partial access.

Exploitation and automatability from CISA (KEV catalog and SSVC triage) for CVE-2024-41710.

EPSS Exploitation Probability

via FIRST.org ↗
41.6%probability of exploitation in next 30 days
High Risk0.00%
Lower risk than most CVEs99th percentile — riskier than 99% of all scored CVEsHighest risk
13.1%24.8%36.5%48.2%19.7%41.6%Apr 26Aug 26Oct 26

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

How urgent is this, really

CVE-2024-41710 by exploitation likelihood (EPSS) against impact (CVSS). Outside the shaded patch-first corner.

Where this sits among everything scored

Of 395,249 CVEs with a current EPSS score, this one falls in the 10–50% band (highlighted). Counts from FIRST.org, log-scaled.

Description

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.

Affected Products

15 products · 15 configurations
OS
6863i sip firmwaremitel
all
OS
6865i sip firmwaremitel
all
OS
6867i sip firmwaremitel
all
OS
6869i sip firmwaremitel
all
OS
6873i sip firmwaremitel
all
OS
6905 sip firmwaremitel
all

Detection & mitigation playbook

Vendor / appliance

  1. Detect

    Inventory every mitel 6863i sip firmware deployment and check each version against the affected-products list above.

  2. Remediation status

    No patch has shipped for CVE-2024-41710 yet — track the mitel 6863i sip firmware advisory for a fixed release and apply the workarounds below in the meantime.

  3. Mitigate without a patch

    If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands. Alongside that, restrict the management interface to trusted networks and apply the vendor's recommended configuration mitigations.

Frequently Asked Questions

A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack, due to insufficient parameter sanitization during the boot process. A successful exploit could allow an attacker to execute arbitrary commands within the context of the system.
O3 Security · Runtime Protection

Is CVE-2024-41710 being exploited in your environment?

Detect and block the exploit chain at execution, on systems you cannot patch yet.

Protect my workloads How runtime protection works
CVE-2024-41710: 6863i Sip Firmware (Medium 6.8, KEV)