CVE-2026-104807: CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') in Mitel Mitel MiVoice Office 400

This vulnerability arises from improper neutralization of input in the Description field of the Configuration → Domains section of the Mitel MiVoice Office 400 web portal (TCP port 443). The application does not properly validate or sanitize user-supplied input before storing and rendering it, enabling an authenticated attacker to inject persistent JavaScript or HTML. When other users view the affected page, the malicious script executes, potentially modifying page content or enabling phishing within the trusted environment.

An authenticated malicious user can inject persistent scripts that execute in the context of other users viewing the affected Description field. This can lead to altered page appearance, display of attacker-controlled content, or phishing attacks within the trusted web application. However, the impact is limited by the requirement for authentication and user interaction, and the CVSS score reflects a low severity.

No vendor advisory or patch information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the Configuration → Domains Description field to trusted users only and consider monitoring for suspicious input. Apply standard XSS mitigations such as input validation and output encoding if possible.