Mitel MiVoice Business Express vulnerabilities

3 CVEs affecting Mitel MiVoice Business Express, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-31784, published 2022-06-17.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2022-26143: MiCollab, MiVoice Business Express Access Control Vulnerability, published 2022-03-10. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 87.3% chance of exploitation in the next 30 days. The TP-240 (aka tp240dvr) component in Mitel MiCollab before 9.4 SP1 FP1 and MiVoice Business Express through 8.1 allows remote attackers to obtain sensitive information and cause a denial of service…
CVE-2022-31784, published 2022-06-17. Critical severity, CVSS 9.8. EPSS: 1.6% chance of exploitation in the next 30 days. A vulnerability in the management interface of MiVoice Business through 9.3 PR1 and MiVoice Business Express through 8.0 SP3 PR3 could allow an unauthenticated attacker (that has network access to…
CVE-2018-18819, published 2019-11-12. Medium severity, CVSS 5.3. EPSS: 1.4% chance of exploitation in the next 30 days. A vulnerability in the web conference chat component of MiCollab, versions 7.3 PR6 (7.3.0.601) and earlier, and 8.0 (8.0.0.40) through 8.0 SP2 FP2 (8.0.2.202), and MiVoice Business Express versions…