CVE-2024-28066 Overview
CVE-2024-28066 is a hardcoded credentials vulnerability affecting Unify CP IP Phone firmware version 1.10.4.3 and a broad range of Mitel and Unify OpenScape desk phones. The firmware ships with a hardcoded root password, allowing an attacker on an adjacent network to authenticate as root without any prior privileges. The issue is tracked under CWE-259: Use of Hard-coded Password and was disclosed by SySS GmbH in advisory SYSS-2024-008.
Critical Impact
An adjacent-network attacker can obtain full root-level control of affected IP phones, enabling call interception, lateral movement into the voice network, and persistent implantation on enterprise telephony endpoints.
Affected Products
- Mitel 6905, 6910, 6915, 6920w, 6930w, 6940w, and 6970 IP phones
- Unify OpenScape CP110, CP210, CP410, CP710, and CPX10 desk phones
- Unify OpenScape DECT and 700D DECT firmware (including CP IP Phone firmware 1.10.4.3)
Discovery Timeline
- 2024-04-08 - CVE-2024-28066 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-28066
Vulnerability Analysis
The vulnerability stems from the inclusion of a static root password embedded directly in the phone firmware image. Any actor able to reach the device on an adjacent network segment can authenticate as the highest-privileged local account. Because the credential is baked into the firmware, it is identical across all deployed units of the same build, turning a single credential recovery into a fleet-wide compromise.
Successful authentication yields full read and write access to the underlying operating system. An attacker can modify configuration files, extract SIP credentials, capture audio from the microphone, tamper with call routing, or pivot into adjoining VLANs used for signaling and management. The Common Weakness Enumeration classifies this pattern as CWE-259, which specifically covers hardcoded passwords used for inbound authentication.
Root Cause
The firmware includes a hardcoded root credential rather than provisioning a device-unique password at first boot or requiring the administrator to set one. Because the value is compiled into the shipping image, it cannot be rotated by end users and is recoverable through firmware extraction and offline analysis of the password hash.
Attack Vector
Exploitation requires network adjacency to the target phone, typically the same VLAN or voice segment used for signaling. The attacker connects to an exposed management or shell service (for example SSH or a debug interface) and authenticates using the recovered root password. No user interaction is required and the attack complexity is low once the credential is known. Full details are documented in the SySS Advisory SYSS-2024-008.
Detection Methods for CVE-2024-28066
Indicators of Compromise
- Successful SSH or shell logins to IP phone management interfaces originating from unexpected hosts on the voice VLAN.
- Unauthorized modifications to phone configuration files, firmware images, or startup scripts on affected Mitel and OpenScape devices.
- Outbound connections from IP phones to non-corporate infrastructure, indicating possible implant callback or SIP hijacking.
Detection Strategies
- Monitor authentication logs on IP phones and voice management platforms for logins to the root account, which should never occur in normal operation.
- Inspect switch and firewall telemetry for lateral movement from voice VLANs to data or server segments.
- Compare firmware versions across the fleet against the vendor's fixed release list and alert on devices still running the vulnerable 1.10.4.3 build.
Monitoring Recommendations
- Enable syslog forwarding from Mitel and Unify phones to a centralized SIEM and create rules for privileged shell access.
- Baseline expected SIP and provisioning traffic per phone, then alert on deviations such as new destinations or unusual call patterns.
- Include IP phones in periodic authenticated vulnerability scans and asset inventories to prevent silent drift back to vulnerable firmware.
How to Mitigate CVE-2024-28066
Immediate Actions Required
- Inventory all Mitel and Unify OpenScape desk phones and DECT devices and identify units running firmware 1.10.4.3 or earlier vulnerable builds.
- Isolate voice endpoints on a dedicated VLAN with strict access control lists between voice, data, and management networks.
- Block inbound SSH and administrative protocols to phones from user workstation subnets.
Patch Information
Mitel and Unify have not published a fixed firmware version in the referenced NVD record. Consult the SySS Advisory SYSS-2024-008 and the vendor support portal for the latest firmware release addressing the hardcoded credential, and apply the update to every affected model listed above.
Workarounds
- Restrict Layer 2 and Layer 3 reachability to phone management ports using port-based ACLs and private VLANs so only the provisioning server can reach the device.
- Disable any non-essential remote management services on the phones, including SSH and debug shells, where the platform allows configuration.
- Deploy 802.1X port authentication on switch ports terminating IP phones to prevent unauthorized devices from joining the voice segment and reaching the vulnerable interface.
# Configuration example: restrict management access to phones on a Cisco switch
interface range GigabitEthernet1/0/1 - 48
switchport mode access
switchport access vlan 20 # voice VLAN
ip access-group VOICE-MGMT-IN in
!
ip access-list extended VOICE-MGMT-IN
permit tcp host 10.10.20.5 any eq 22 # provisioning server only
deny tcp any any eq 22
deny tcp any any eq 23
permit ip any any
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
