CVE-2024-36446 Overview
CVE-2024-36446 is an authentication bypass vulnerability in the provisioning manager component of Mitel MiVoice MX-ONE through version 7.6 SP1. The flaw stems from improper access control, allowing an authenticated attacker to bypass the authorization schema and gain unauthorized access to protected functions. Mitel disclosed the issue in Mitel Security Advisory #24-0017. The vulnerability affects an enterprise unified communications platform widely deployed in telecommunications environments.
Critical Impact
A low-privileged authenticated attacker can bypass the authorization schema over the network to compromise confidentiality, integrity, and availability of the MX-ONE provisioning manager.
Affected Products
- Mitel MiVoice MX-ONE versions through 7.6 (base release)
- Mitel MiVoice MX-ONE 7.6 SP1
- Mitel MiVoice MX-ONE provisioning manager component
Discovery Timeline
- 2024-08-13 - CVE-2024-36446 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-36446
Vulnerability Analysis
The provisioning manager component in Mitel MiVoice MX-ONE fails to enforce authorization checks correctly on privileged operations. An authenticated user with low privileges can craft requests that bypass the intended authorization schema. This exposes administrative or restricted provisioning functions to accounts that should not access them.
Mitel classifies this issue as an authentication bypass caused by improper access control. Because the provisioning manager handles user, extension, and system configuration on the MX-ONE platform, unauthorized access can pivot into broader telephony infrastructure compromise. NVD assigns the weakness NVD-CWE-noinfo, indicating no specific CWE was provided by the source.
Root Cause
The root cause is improper access control within the provisioning manager's authorization checks. The component appears to authenticate the session but does not consistently verify whether the authenticated principal is authorized for the requested action. This missing or incomplete authorization enforcement enables a horizontal or vertical privilege escalation depending on the targeted endpoint.
Attack Vector
Exploitation requires network access to the provisioning manager and valid, low-privilege credentials. No user interaction is required, and attack complexity is low. After authenticating, the attacker issues requests to provisioning endpoints that should be restricted, bypassing the authorization schema. Successful exploitation impacts confidentiality, integrity, and availability of the affected component.
No public proof-of-concept, ExploitDB entry, or CISA KEV listing exists for CVE-2024-36446 at the time of writing. See Mitel Security Advisory #24-0017 for vendor-supplied technical details.
Detection Methods for CVE-2024-36446
Indicators of Compromise
- Provisioning manager access logs showing low-privilege accounts invoking administrative or restricted endpoints.
- Unexpected changes to user accounts, extensions, routing rules, or system configuration outside change-management windows.
- Authenticated HTTP requests to provisioning URLs originating from unusual source addresses or at atypical hours.
Detection Strategies
- Review provisioning manager audit logs for authorization decisions and correlate them with the authenticated user's assigned role.
- Alert on requests where a non-administrative account successfully invokes an administrative provisioning action.
- Baseline normal provisioning activity per account and flag deviations in request paths, parameters, or volume.
Monitoring Recommendations
- Forward MX-ONE provisioning manager logs to a centralized SIEM or data lake for retention and correlation.
- Monitor for repeated 4xx followed by 2xx responses on the same endpoint, which may indicate authorization probing.
- Track configuration diffs on MX-ONE and alert on changes not tied to an approved change ticket.
How to Mitigate CVE-2024-36446
Immediate Actions Required
- Apply the fixed release referenced in Mitel Security Advisory #24-0017 as soon as possible.
- Restrict network access to the MX-ONE provisioning manager to trusted administrative networks and jump hosts.
- Audit all provisioning manager accounts and remove or disable accounts that are unused or over-privileged.
- Rotate credentials for provisioning manager accounts, particularly any shared or service accounts.
Patch Information
Mitel has released remediation guidance in Mitel Security Advisory #24-0017. Administrators running MiVoice MX-ONE through 7.6 SP1 should follow the vendor advisory to obtain the fixed version and upgrade instructions for the provisioning manager component.
Workarounds
- Place the provisioning manager behind a VPN or dedicated management network to eliminate exposure to untrusted networks.
- Enforce network-level access control lists limiting which endpoints can reach the provisioning manager service.
- Enable and centrally review provisioning manager audit logging to detect unauthorized activity until the patch is applied.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
