1## autogenerated on 2025-12-29 14:06:31
2name: crowdsecurity/vpatch-CVE-2025-47188
3description: 'Detects OS command injection in Mitel 6000 series SIP Phones via ringtone upload functionality.'
4rules:
5  - and:
6      - zones:
7          - URI
8        transform:
9          - lowercase
10        match:
11          type: contains
12          value: /cgi-bin/webconfig
13      - zones:
14          - ARGS
15        variables:
16          - page
17        transform:
18          - lowercase
19        match:
20          type: equals
21          value: upload_ringtone
22      - zones:
23          - FILENAMES
24        transform:
25          - lowercase
26        match:
27          type: contains
28          value: '$('
29
30labels:
31  type: exploit
32  service: http
33  confidence: 3
34  spoofable: 0
35  behavior: 'http:exploit'
36  label: 'Mitel 6000 - RCE'
37  classification:
38    - cve.CVE-2025-47188
39    - attack.T1190
40    - cwe.CWE-78
41