Mitel SIP Phones CVE-2024-41710: Boot Command Injection

What to do

1. Inventory Mitel 6800, 6900, 6900w and 6970 devices and record their firmware version.
2. Upgrade every affected device to R6.4.0.HF2 (R6.4.0.137) or later through your provisioning server.
3. Replace the default admin password on every phone and push a unique, strong one through provisioning.
4. Make sure no phone web interface is reachable from the internet, and limit it on the LAN to management hosts.
5. Block outbound internet access from the voice VLAN except to your SIP and provisioning services.

How to check if you are affected or compromised

• Look for phones making outbound HTTP connections or downloads to hosts other than your provisioning and SIP servers.
• Search proxy or firewall logs for POST requests to /8021xsupport.html on phones.
• Check each phone's 802.1X identity and hostname settings for shell characters or download commands.
• Search DNS logs for the Aquabot download host raw2.intenseapi[.]com listed by Akamai.

What happened#

On July 17, 2024, Mitel published advisory 24-0019. It covers a command injection in the boot process of its 6800, 6900 and 6900w Series SIP phones and the 6970 Conference Unit. A July 30 revision assigned CVE-2024-41710. The security bulletin says an authenticated attacker with administrative privilege can run arbitrary commands on the phone because parameters are not sanitized during boot. Mitel rates it High, CVSS 3.1 7.2. CISA's enrichment on the CVE record scores it 6.8 with an adjacent-network vector. Kyle Burns of Packetlabs found it.

Burns' write-up shows the mechanism on a 6869i running R6.3.0.1020. A crafted POST to the 802.1X support page (8021xsupport.html) smuggles a line break into the local configuration file, /nvdata/etc/local.cfg. On the next boot, the injected line overwrites the hostname entry. The DHCP client then runs the attacker's shell commands as root.

In early January 2025, Akamai's SIRT saw exploit attempts in its honeypots that closely matched Burns' public proof of concept. Akamai said it knew of no earlier in-the-wild exploitation. The payload used curl to fetch a bin.sh script that downloads Mirai binaries for many CPU types. Akamai named the malware Aquabotv3, a Mirai-based DDoS botnet that is advertised as DDoS-for-hire on Telegram. CISA added the CVE to the KEV catalog on February 12, 2025, with a March 5 deadline.

Who is affected#

All 6800, 6900, 6900w and 6970 devices on R6.4.0.HF1 (R6.4.0.136) or earlier. The fix is R6.4.0.HF2 (R6.4.0.137) or later. Mitel lists no workaround.

Do you really need to act?#

Check, but expect this to be quick for most. The attacker needs admin access to the phone's web interface, and a well-run voice network does not expose phones to the internet. Akamai notes that botnets like this "rely on common password libraries" to log in. The Mitel 6800/6900 default admin login is admin / 22222, per Telnyx's setup guide. Phones that kept that password and are reachable from an attacker's network are the real risk. A compromised phone becomes a DDoS bot running as root inside your voice network. Phones on HF2 with unique passwords are not exposed to this bug.

What to do now#

1. Inventory affected models and record their firmware. A sweep such as nmap -p 80,443 --open <voice-vlan> finds phone web interfaces you may have missed.
2. Push R6.4.0.HF2 (R6.4.0.137) or later from your provisioning server and confirm each phone took it.
3. Set a unique admin password on every phone through provisioning, not by hand.
4. Block inbound internet access to phones. Restrict the web interface to management hosts.
5. Deny outbound internet traffic from the voice VLAN except to SIP and provisioning services.

How to tell if you were hit#

• Phones should not download files from the internet. Look for HTTP connections or downloads from phone IPs to unknown hosts.
• Search firewall or proxy logs for POSTs to /8021xsupport.html.
• Inspect each phone's 802.1X identity and hostname settings for shell characters or curl/wget commands.
• Search DNS logs for raw2.intenseapi[.]com, the download host in Akamai's report. Use Akamai's Snort and YARA rules and hashes for deeper checks.
• Factory-reset and reprovision any phone that shows these signs, then confirm it runs HF2 or later.

Timeline#

• Jul 17, 2024 — Mitel publishes advisory and bulletin 24-0019.
• Jul 30, 2024 — Bulletin revision 2.0 assigns CVE-2024-41710.
• Aug 12, 2024 — The CVE is published. Burns releases a proof of concept in mid-August.
• Jan 28, 2025 — Akamai reports Aquabotv3 exploitation seen since early January.
• Feb 12, 2025 — CISA adds the CVE to KEV.
• Mar 5, 2025 — Federal remediation deadline.

Vulnerability records

• CVE-2024-41710 · KEV 2025-02-12 · A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Mitel — Product Security Advisory 24-0019 mitel.com
2. Mitel — Security Bulletin 24-0019-001 v2.0 mitel.com
3. Kyle Burns (Packetlabs) — Mitel 6800 R6.3.0.1020 command injection write-up github.com
4. CVE record — CVE-2024-41710 cve.org
5. CISA — Known Exploited Vulnerabilities: CVE-2024-41710 cisa.gov
6. Akamai SIRT — Active Exploitation: New Aquabot Variant Phones Home akamai.com
7. Telnyx — Mitel 6800/6900 SIP configuration guide (default credentials) support.telnyx.com