VulnerabilityPublished 24 Jun 2025

CVE-2025-27827: A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could

Source CVE Database V5

Not known to be exploited.

Data as of 26 Oct 2026, 11:07 UTC

Severity

High

Rated High by the CNA (mitre) · No CVSS score from NVD or the CNA

EPSS: 0.3% chance of exploitation in 30 days – higher than 28% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Affects: Mitel MiContact Center Business through 10.2.0.3

Exploitation evidence

Disclosed: evidence found.
CVE published 24 Jun 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

To mitigate this vulnerability, European organizations should prioritize upgrading Mitel MiContact Center Business to versions beyond 10.2.0.3 once patches become available. In the interim, organizations should implement strict network segmentation to isolate the chat component from critical systems and sensitive data repositories. Deploying Web Application Firewalls (WAFs) with custom rules to detect and block anomalous chat session behaviors or injection attempts can reduce risk. User awareness training focusing on social engineering and phishing risks related to chat interactions is essential to minimize the likelihood of user interaction-based exploitation. Monitoring and logging chat session activities for unusual access patterns or message anomalies can aid in early detection of exploitation attempts. Organizations should also review and enforce strict session management policies, including session timeouts and re-authentication requirements for sensitive operations within the chat system. Finally, consider disabling or restricting legacy chat components if they are not essential to business operations until a secure update is applied.

Description

A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.2.0.3 could allow an unauthenticated attacker to conduct an information disclosure attack due to improper handling of session data. A successful exploit requires user interaction and could allow an attacker to access sensitive information, leading to unauthorized access to active chat rooms, reading chat data, and sending messages during an active chat session.

Impact

For European organizations, the impact of this vulnerability could be significant, particularly for those relying on Mitel MiContact Center Business for customer service and internal communications. Unauthorized access to chat sessions could lead to leakage of sensitive customer information, including personal data protected under GDPR, resulting in regulatory penalties and reputational damage. Attackers could manipulate chat conversations, potentially misleading customers or employees, causing operational disruptions or fraud. The integrity of customer interactions and internal communications would be undermined, affecting trust and service quality. Additionally, organizations in regulated sectors such as finance, healthcare, and telecommunications could face heightened risks due to the sensitivity of the data exchanged via these chat systems. The requirement for user interaction limits automated exploitation but does not eliminate risk, especially in environments with high volumes of chat traffic and users less aware of social engineering tactics.

References

Community reviews

Loading reviews…