CVE-2024-37569: Command Injection
Source CVE Database V5
Not known to be exploited · CVSS 8.3 High.
Data as of 26 Oct 2026, 12:29 UTC
- EPSS
- 3.1% chance of exploitation in 30 days – higher than 88% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:LExploitation evidence
Disclosed: evidence found.
CVE published 9 Jun 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
AI-suggested
To mitigate CVE-2024-37569, organizations should immediately verify if they use Mitel 6869i devices running affected firmware versions and prioritize patching once vendor updates become available. Until patches are released, restrict access to the device management interface to trusted networks and users only, employing network segmentation and strict access controls. Implement strong authentication mechanisms, including multi-factor authentication, to reduce the risk of credential compromise. Monitor device logs and network traffic for unusual activity indicative of exploitation attempts, such as unexpected hostname changes or shell command executions. Consider deploying intrusion detection systems tailored to detect command injection patterns targeting VoIP devices. Additionally, conduct regular security audits of VoIP infrastructure and educate administrators on secure configuration practices. If possible, disable or restrict the provis.html endpoint or any unnecessary web management interfaces to reduce the attack surface. Maintain an inventory of all VoIP devices and their firmware versions to ensure timely vulnerability management.
Description
An issue was discovered on Mitel 6869i through 4.5.0.41 and 5.x through 5.0.0.1018 devices. A command injection vulnerability exists in the hostname parameter taken in by the provis.html endpoint. The provis.html endpoint performs no sanitization on the hostname parameter (sent by an authenticated user), which is subsequently written to disk. During boot, the hostname parameter is executed as part of a series of shell commands. Attackers can achieve remote code execution in the root context by placing shell metacharacters in the hostname parameter.