CVE-2026-104805— Mitel MiVoice Office 400 备份恢复任意文件写入导致root代码执行漏洞
一分钟漏洞结论
影响对象
Mitel Mitel MiVoice Office 400
利用判断
尚无明确在野利用证据，仍需结合暴露面评估
建议动作
优先检查厂商安全公告和参考链接中的修复版本；无法立即升级时，限制受影响服务暴露并加强监测。
DigitalCanion 发现备份恢复功能中存在一个漏洞，允许具有配置备份仓库访问权限的攻击者在恢复过程中向系统植入任意文件。 该缺陷具体存在于备份恢复机制中，该机制未能正确验证还原的 TGZ 归档文件中包含的路径、文件类型、完整性和真实性。应用程序在解压归档文件之前未执行文件签名验证，从而允许特别构造的备份文件包含攻击者可控的文件。 因此，拥有备份 SFTP 或其他配置仓库访问权限的攻击者可以提供一个恶意的 TGZ 归档文件，当系统恢复该文件时，可能会在底层 Linux 系统中放置任意文件。根据提取文件的位置和
获取后续新漏洞提醒
登录后订阅
一、 漏洞 CVE-2026-104805 基础信息
漏洞信息
对漏洞内容有疑问？看看神龙的深度分析是否有帮助！
查看神龙十问 ↗
尽管我们使用了先进的大模型技术，但其输出仍可能包含不准确或过时的信息。神龙努力确保数据的准确性，但请您根据实际情况进行核实和判断。
Vulnerability Title
Mitel MiVoice Office 400 Backup Restoration Arbitrary File Write Leading to Root Code Execution
来源: CVE Program / CVE List V5
Vulnerability Description
DigitalCanion has discovered a vulnerability in the backup restoration functionality that allows an attacker with access to the configured backup repository to introduce arbitrary files into the system during restoration.
The specific flaw exists within the backup restoration mechanism, which fails to properly validate the paths, file types, integrity, and authenticity of files contained within a restored TGZ archive. The application does not perform file-signature verification before extracting the archive, allowing a specially crafted backup to contain attacker-controlled files.
An attacker with access to the backup SFTP or other configured repository can therefore provide a malicious TGZ archive that, when restored by the system, may place arbitrary files on the underlying Linux system. Depending on the location and permissions of the extracted files, this behavior can potentially be leveraged to achieve arbitrary code execution with root privileges and compromise the underlying virtual machine.
The absence of enforced backup passwords further reduces the protection provided by the backup mechanism and may facilitate unauthorized access to the repository.
来源: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:P/AU:Y/R:U/V:D/RE:M/U:Amber
来源: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
来源: CVE Program / CVE List V5
受影响产品
| 厂商 | 产品 | 影响版本 | CPE | 订阅 |
|---|---|---|---|---|
| Mitel | Mitel MiVoice Office 400 | 11.0.96.0 | - |
|
二、漏洞 CVE-2026-104805 的公开POC
| # | POC 描述 | 源链接 | 神龙链接 |
|---|
AI 生成 POC
高级
未找到公开 POC。
登录以生成 AI POC三、漏洞 CVE-2026-104805 的情报信息
请登录查看更多情报信息。
CVE-2026-104805 其他参考 (1)
同批安全公告 · Mitel · 2026-10-05 · 共 8 条
| CVE-2026-104706 | 8.4 HIGH | Mitel MiVoice Office 400 系统文件路径遍历漏洞 |
| CVE-2026-104810 | 8.4 HIGH | Mitel MiVoice Office 400 文件浏览目录遍历漏洞 |
| CVE-2026-104809 | 8.4 HIGH | Mitel MiVoice Office 400 共享对象劫持导致远程代码执行漏洞 |
| CVE-2026-104811 | 8.4 HIGH | Mitel MiVoice Office 400 WAV上传代码执行漏洞 |
| CVE-2026-104806 | 5.5 MEDIUM | Mitel MiVoice Office 400 系统日志路径遍历信息泄露漏洞 |
| CVE-2026-104807 | 1.9 LOW | Mitel MiVoice Office 400 存储型跨站脚本漏洞 |
| CVE-2026-104808 | 1.9 LOW | Mitel MiVoice Office 400 存储型跨站脚本漏洞 |
IV. Related Vulnerabilities
Same product: Mitel MiVoice Office 400
V. Comments for CVE-2026-104805
暂无评论