---
title: "Mitel SIP Phones CVE-2024-41710: Boot Command Injection"
url: https://erroneo.us/security/briefs/mitel-sip-phones-cve-2024-41710-aquabot/
description: "Mitel 6800/6900/6900w phones and the 6970 on R6.4.0.HF1 or older can be rooted by an admin; Aquabot used it in 2025. Update to R6.4.0.HF2 and fix passwords."
type: security-brief
section: "Security Digest"
date_published: 2024-07-17
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-41710"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Mitel SIP Phones CVE-2024-41710: Boot Command Injection

**Verdict: Check exposure.** A fix has existed since July 2024 and the bug needs admin access to the phone, but a Mirai botnet exploited it in 2025; phones on old firmware with default passwords or reachable web interfaces are the real risk.

- **Who must act:** Organizations with Mitel 6800, 6900, 6900w or 6970 devices on R6.4.0.HF1 (R6.4.0.136) or older, especially where the phone web interface is reachable from untrusted networks or still uses the default admin password.
- **Who can relax:** Sites whose Mitel phones run R6.4.0.HF2 or later, use non-default admin passwords and sit on a voice network that cannot be reached from the internet.
- **Affected:** Mitel 6800, 6900 and 6900w Series SIP Phones, R6.4.0.HF1 (R6.4.0.136) and earlier; Mitel 6970 Conference Unit, R6.4.0.HF1 (R6.4.0.136) and earlier
- **Fixed:** R6.4.0.HF2 (R6.4.0.137) or later for all affected models
- **CVEs:** CVE-2024-41710
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Inventory Mitel 6800, 6900, 6900w and 6970 devices and record their firmware version.
2. Upgrade every affected device to R6.4.0.HF2 (R6.4.0.137) or later through your provisioning server.
3. Replace the default admin password on every phone and push a unique, strong one through provisioning.
4. Make sure no phone web interface is reachable from the internet, and limit it on the LAN to management hosts.
5. Block outbound internet access from the voice VLAN except to your SIP and provisioning services.

### How to check if you are affected

- Look for phones making outbound HTTP connections or downloads to hosts other than your provisioning and SIP servers.
- Search proxy or firewall logs for POST requests to /8021xsupport.html on phones.
- Check each phone's 802.1X identity and hostname settings for shell characters or download commands.
- Search DNS logs for the Aquabot download host raw2.intenseapi[.]com listed by Akamai.

## What happened

On July 17, 2024, Mitel published [advisory 24-0019](https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019). It covers a command injection in the boot process of its 6800, 6900 and 6900w Series SIP phones and the 6970 Conference Unit. A July 30 revision assigned CVE-2024-41710. The [security bulletin](https://www.mitel.com/sites/default/files/2026-02/24-0019_24-0019-001.pdf) says an authenticated attacker with administrative privilege can run arbitrary commands on the phone because parameters are not sanitized during boot. Mitel rates it High, CVSS 3.1 7.2. CISA's enrichment on the [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-41710) scores it 6.8 with an adjacent-network vector. Kyle Burns of Packetlabs found it.

Burns' [write-up](https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md) shows the mechanism on a 6869i running R6.3.0.1020. A crafted POST to the 802.1X support page (`8021xsupport.html`) smuggles a line break into the local configuration file, `/nvdata/etc/local.cfg`. On the next boot, the injected line overwrites the `hostname` entry. The DHCP client then runs the attacker's shell commands as root.

In early January 2025, [Akamai's SIRT](https://www.akamai.com/blog/security-research/new-aquabot-mirai-variant-exploiting-mitel-phones) saw exploit attempts in its honeypots that closely matched Burns' public proof of concept. Akamai said it knew of no earlier in-the-wild exploitation. The payload used `curl` to fetch a `bin.sh` script that downloads Mirai binaries for many CPU types. Akamai named the malware Aquabotv3, a Mirai-based DDoS botnet that is advertised as DDoS-for-hire on Telegram. CISA added the CVE to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41710) on February 12, 2025, with a March 5 deadline.

## Who is affected

All 6800, 6900, 6900w and 6970 devices on R6.4.0.HF1 (R6.4.0.136) or earlier. The fix is R6.4.0.HF2 (R6.4.0.137) or later. Mitel lists no workaround.

## Do you really need to act?

Check, but expect this to be quick for most. The attacker needs admin access to the phone's web interface, and a well-run voice network does not expose phones to the internet. Akamai notes that botnets like this "rely on common password libraries" to log in. The Mitel 6800/6900 default admin login is `admin` / `22222`, per [Telnyx's setup guide](https://support.telnyx.com/en/articles/6249691-mitel-6800-6900-sip). Phones that kept that password and are reachable from an attacker's network are the real risk. A compromised phone becomes a DDoS bot running as root inside your voice network. Phones on HF2 with unique passwords are not exposed to this bug.

## What to do now

1. Inventory affected models and record their firmware. A sweep such as `nmap -p 80,443 --open <voice-vlan>` finds phone web interfaces you may have missed.
2. Push R6.4.0.HF2 (R6.4.0.137) or later from your provisioning server and confirm each phone took it.
3. Set a unique admin password on every phone through provisioning, not by hand.
4. Block inbound internet access to phones. Restrict the web interface to management hosts.
5. Deny outbound internet traffic from the voice VLAN except to SIP and provisioning services.

## How to tell if you were hit

- Phones should not download files from the internet. Look for HTTP connections or downloads from phone IPs to unknown hosts.
- Search firewall or proxy logs for POSTs to `/8021xsupport.html`.
- Inspect each phone's 802.1X identity and hostname settings for shell characters or `curl`/`wget` commands.
- Search DNS logs for `raw2.intenseapi[.]com`, the download host in Akamai's report. Use Akamai's Snort and YARA rules and hashes for deeper checks.
- Factory-reset and reprovision any phone that shows these signs, then confirm it runs HF2 or later.

## Timeline

- Jul 17, 2024 — Mitel publishes advisory and bulletin 24-0019.
- Jul 30, 2024 — Bulletin revision 2.0 assigns CVE-2024-41710.
- Aug 12, 2024 — The CVE is published. Burns releases a proof of concept in mid-August.
- Jan 28, 2025 — Akamai reports Aquabotv3 exploitation seen since early January.
- Feb 12, 2025 — CISA adds the CVE to KEV.
- Mar 5, 2025 — Federal remediation deadline.

## Sources

1. [Mitel — Product Security Advisory 24-0019](https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-24-0019)
2. [Mitel — Security Bulletin 24-0019-001 v2.0](https://www.mitel.com/sites/default/files/2026-02/24-0019_24-0019-001.pdf)
3. [Kyle Burns (Packetlabs) — Mitel 6800 R6.3.0.1020 command injection write-up](https://github.com/kwburns/CVE/blob/main/Mitel/6.3.0.1020/README.md)
4. [CVE record — CVE-2024-41710](https://www.cve.org/CVERecord?id=CVE-2024-41710)
5. [CISA — Known Exploited Vulnerabilities: CVE-2024-41710](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-41710)
6. [Akamai SIRT — Active Exploitation: New Aquabot Variant Phones Home](https://www.akamai.com/blog/security-research/new-aquabot-mirai-variant-exploiting-mitel-phones)
7. [Telnyx — Mitel 6800/6900 SIP configuration guide (default credentials)](https://support.telnyx.com/en/articles/6249691-mitel-6800-6900-sip)

---
Source page: https://erroneo.us/security/briefs/mitel-sip-phones-cve-2024-41710-aquabot/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt