How severe is CVE-2023-31457?

CVE-2023-31457 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.

Is CVE-2023-31457 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (58th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2023-31457?

CVE-2023-31457 affects Mitel Mivoice Connect. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2023-31457?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.

When was CVE-2023-31457 published?

CVE-2023-31457 was published on 2023-05-24 and last updated on 2026-06-17.

CVE-2023-31457

CVE-2023-31457 is a critical-severity vulnerability in Mitel Mivoice Connect with a CVSS 3.x base score of 9.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.

Key facts

Severity: Critical (CVSS 3.x base score 9.8)
EPSS exploit prediction: 1% (58th percentile)
Actively exploited: Not listed in CISA KEV
Affected product: Mitel Mivoice Connect
Published: 2023-05-24
Last modified: 2026-06-17

Description

A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.

Frequently asked questions

What is CVE-2023-31457?: A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network access to execute arbitrary scripts due to improper access control.
How severe is CVE-2023-31457?: CVE-2023-31457 has a CVSS 3.x base score of 9.8, rated critical severity. It is exploitable over network with low attack complexity, requires no privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
Is CVE-2023-31457 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (58th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2023-31457?: CVE-2023-31457 affects Mitel Mivoice Connect. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2023-31457?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its critical severity, prioritise patching exposed systems.
When was CVE-2023-31457 published?: CVE-2023-31457 was published on 2023-05-24 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*

More vulnerabilities in Mitel Mivoice Connect

CVE-2023-32748 — Critical (CVSS 9.8): The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated…
CVE-2023-31458 — Critical (CVSS 9.8): A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier…
CVE-2022-29499 — Critical (CVSS 9.8): The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of…
CVE-2020-10211 — Critical (CVSS 9.8): A remote code execution vulnerability in UCB component of Mitel MiVoice Connect before 19.1 SP1 could allow an…
CVE-2023-31459 — High (CVSS 8.8): A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect versions 9.6.2208.101 and earlier…
CVE-2023-39289 — High (CVSS 7.5): A vulnerability in the Connect Mobility Router component of Mitel MiVoice Connect through 9.6.2208.101 could allow an…

All CVEs affecting Mitel Mivoice Connect →