Mitel - RCE (CVE-2025-47188)

CVE-2025-47188 is a command injection vulnerability in Mitel 6800, 6900, 6900w Series SIP Phones, and the 6970 Conference Unit, allowing unauthenticated attackers to execute arbitrary commands due to improper parameter sanitization. Exploitation of this flaw could lead to unauthorized disclosure or modification of sensitive configuration data, potentially impacting device operation and security.

CrowdSec has been tracking this vulnerability and its exploits since 29th of December 2025.

Data from the CrowdSec community indicates that exploitation of CVE-2025-47188 is highly selective and intelligence-driven. Threat actors use advanced reconnaissance and carefully choose their targets, often as part of sophisticated campaigns or advanced persistent threat operations. Additionally, according to week-over-week analysis by CrowdSec, exploitation of CVE-2025-47188 is surging. Attack volumes are spiking well above historical norms, indicating widespread and escalating interest from threat actors. CVE-2025-47188 is currently experiencing high visibility and active exploitation across the internet.

Attackers exploit the /cgi-bin/webconfig endpoint with parameters like page=upload_ringtone and action=submit to upload malicious files and inject OS commands, targeting Mitel SIP phones and conference units.