CVE-2003-20001

Executive Summary

CVE-2003-20001 is a vulnerability in Mitel ICP VoIP 3100 devices that leads to information disclosure of call data and SMDR records. When a remote user attempts to log in via TELNET during the login wait time and an external call arrives, the system incorrectly outputs call activity details, including service type, extension numbers, and dialed digits. This flaw allows an unauthenticated attacker to passively intercept sensitive call metadata by simply initiating a TELNET session and waiting for a call event. The vulnerability has a public proof-of-concept (PoC) exploit from 2003, but no official patch has been released, leaving affected devices exposed. The EPSS score is 0.0%, indicating low exploitation likelihood in the wild, but the lack of a patch makes it a persistent risk for legacy systems.

Supply Chain & Package Security

Not applicable (hardware appliance, not a software package).

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (NVD) – No vector assigned due to age and lack of scoring.
• Threat Level: Medium (Information Disclosure)
• Attack Vector: Network (TELNET)
• Attack Complexity: Low (no authentication required)
• Privileges Required: None
• User Interaction: None
• Impact: Confidentiality (Low) – call metadata exposed; Integrity/availability unaffected.

Deep Dive & Mechanics

The vulnerability resides in the TELNET login handler of Mitel ICP VoIP 3100 devices. During the authentication process, the system enters a wait state for user credentials. If an external call arrives during this window, the TELNET session inadvertently outputs SMDR (Station Message Detail Recording) data to the terminal. This data includes:

• SEQ: Sequence number
• CODE: Event code (e.g., ICIN, OGIN, ANSW)
• EXT: Extension number
• ACC: Account code
• TIME: Timestamp
• RX/TX: Source/destination identifiers
• DURATION: Call duration
• LN: Line number
• DIALLED DIGITS: Phone numbers dialed or calling
• COST: Call cost

The output is raw SMDR records, which are normally logged for billing and auditing. The bug causes these records to be printed to the TELNET console instead of being suppressed during login. The attacker does not need valid credentials; simply connecting and waiting is sufficient.

Vulnerable vs. Patched Code

No patch is available. The vulnerable code is the TELNET daemon’s login routine, which fails to suppress SMDR output during the authentication wait state. A patched version would need to buffer or discard SMDR output until after authentication completes.

Exploitation & Lab Setup

Red Team

The exploit is trivial and requires only a TELNET client. The attacker connects to the target IP on port 23 (TELNET) and waits for a call event. The SMDR data is printed directly to the terminal.

Exploit-DB Code (provided):

# Exploit Title: Mitel mitel-cs018 - Call Data Information Disclosure
# Date: 2003-07-28
# Exploit Author: Andrea Intilangelo (acme olografix / paranoici)
# Vendor Homepage: www.mitel.com
# Version: mitel-cs018
# Tested on: Windows, Linux

# Usage: telnet <target_ip> 23
# Then wait for an external call to trigger the disclosure.

Lab Setup:

1. Deploy a Mitel ICP VoIP 3100 device in an isolated network.
2. From an attacker machine (Kali Linux), run: telnet 192.168.1.2
3. Wait for a call to arrive (simulate using a softphone or PSTN simulator).
4. Observe SMDR records printed to the TELNET session.

Example Output:

Username: 155 OGIN 149        11:11:55                        D 2
156 ICIN            11:12: 6                        D 4 0xxxXxxxxx
157 XFIC 156        11:12: 6 151            0: 9:47 D 3
...

Blue Team

• Detection: Monitor TELNET sessions for unexpected SMDR output. Use network traffic analysis to detect anomalous TELNET connections.
• Prevention: Disable TELNET and use SSH instead. If TELNET is required, restrict access via firewall rules to trusted IPs only.
• Mitigation: No patch exists; consider replacing the device or isolating it from untrusted networks.

Indicators of Compromise (IOCs)

• Network: TELNET connections (port 23) to Mitel ICP VoIP 3100 devices.
• Logs: SMDR records appearing in TELNET session logs.
• Strings: Patterns like OGIN, ICIN, ANSW, XFIC in TELNET traffic.
• File: No file-based IOCs.

Detection Engineering

YARA Rule

rule Mitel_SMDR_Disclosure {
    meta:
        description = "Detects SMDR data disclosure in TELNET sessions"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2003-20001"
    strings:
        $smdr1 = /[0-9]{3} (OGIN|ICIN|ANSW|XFIC|EXIC|EXOG|HDIN|HREC|ABND)/
        $smdr2 = /D [0-9] [0-9xX]{7,}/
    condition:
        any of them
}

Sigma Rule

title: Mitel ICP VoIP 3100 SMDR Information Disclosure
id: 7a8b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects TELNET sessions containing SMDR call data from Mitel devices
author: Valters IT
logsource:
    category: network_connection
    product: suricata
detection:
    selection:
        dest_port: 23
        payload|contains:
            - 'OGIN'
            - 'ICIN'
            - 'ANSW'
            - 'XFIC'
    condition: selection
falsepositives:
    - Legitimate SMDR logging via TELNET (rare)
level: medium

Suricata Rule

alert tcp $EXTERNAL_NET any -> $HOME_NET 23 (msg:"Mitel ICP VoIP 3100 SMDR Information Disclosure"; flow:to_server,established; content:"OGIN"; distance:0; within:100; content:"ICIN"; distance:0; within:100; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable TELNET service on the device. Use SSH for remote administration.
• Network: Restrict TELNET access to management VLANs only.
• Long-term: Replace the Mitel ICP VoIP 3100 with a supported model or apply a vendor-supplied firmware update if available (none currently).
• Monitoring: Implement detection rules (YARA, Sigma, Suricata) to alert on SMDR disclosure attempts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert