CVE-2026-104810

Executive Summary

CVE-2026-104810 is a directory traversal vulnerability in the web management portal of Mitel MiVoice Office 400 that allows an authenticated remote attacker to access and delete files located outside the intended directory. Because the flaw permits deletion of files belonging to both the Mitel application and the underlying Linux operating system, successful exploitation can render the system inoperable, resulting in a denial-of-service condition. The vulnerability has no publicly available proof-of-concept, no Nuclei template, no EPSS score, and no vendor-confirmed patch, leaving affected deployments unmitigated unless compensating controls are applied.

Technical Analysis

The vulnerability resides in the web portal of Mitel MiVoice Office 400 that listens on TCP port 443 (HTTPS). The specific functional area affected is the File Browser feature found under the navigation path Maintenance → File Management → File Browser. This interface is designed to allow authenticated administrators to manage files within an intended, restricted directory. The vulnerability is classified as a directory traversal (path traversal) issue, catalogued as CWE-31 ("Path Traversal: 'dir..\filename'").

At the vulnerability-class level, a directory traversal flaw occurs when user-supplied input that references a file path is not properly sanitized or canonicalized before being used in file system operations. In this instance, the File Browser functionality within the web portal fails to adequately restrict the file paths it processes. An authenticated attacker can supply path sequences that resolve outside of the intended directory. This enables both read (access) and, critically, deletion of arbitrary files reachable by the web application's process privileges.

The impact scope is significant because the flaw is not limited to the Mitel application's own data directory. The description explicitly states that access and deletion extend to "files belonging to the Mitel application and the underlying Linux system." This means the traversal escapes the application sandbox entirely and reaches operating-system-level files. Deleting critical application binaries, configuration stores, or OS system files can directly cause service failure and system instability, which the description characterizes as a denial-of-service condition affecting the underlying system.

The attack surface is the authenticated HTTPS web portal on port 443. While authentication is required, the vulnerability does not require any elevated privilege beyond what is necessary to reach the File Management interface, meaning a low-privileged but authenticated user may be able to exploit it depending on the deployment's role configuration. Insufficient technical detail is available to determine the precise parameter name, endpoint, or encoding method used to carry the traversal payload, and no such specifics should be assumed.

Exploitation Scenarios

No public proof-of-concept is available; the following attack chain is inferred from the vulnerability class and the constraints stated in the NVD description.

1. Reconnaissance and target identification. An attacker scans for exposed Mitel MiVoice Office 400 management interfaces, typically identified by HTTPS on TCP port 443 presenting the MiVoice Office 400 web portal. Because the portal is a management plane, exposed instances accessible from untrusted networks represent the primary target set.

2. Authentication. The attacker must obtain valid credentials for the web portal. The description states authentication is required. This could be achieved through legitimate low-privileged access, credential reuse, or prior credential compromise. No authentication bypass is described in this CVE.

3. Triggering the traversal flaw. Once authenticated, the attacker navigates to Maintenance → File Management → File Browser. Within this feature, the attacker supplies crafted path input intended to escape the intended directory. Because the application fails to properly restrict the path (CWE-31), the resolved path can point to files outside the intended root, including application and Linux system files.

4. Payload/execution at the vulnerability-class level. The manipulation consists of injecting traversal sequences into the file path parameter(s) handled by the File Browser. The result is an unauthorized file operation — specifically a delete operation — against resources outside the intended directory. No specific function names, parameters, or payload strings are provided in the available data and none are asserted here.

5. Post-exploitation impact. The attacker deletes sensitive or critical files. Deletion of application files can break the MiVoice Office 400 service; deletion of Linux system files can destabilize or crash the host. The cumulative effect is a denial-of-service condition affecting the underlying system. Notably, the confidentiality impact of the read capability (accessing files outside the intended directory) also represents an information-disclosure risk, though the CVE emphasizes deletion and DoS.

Impact Assessment

This vulnerability has a high availability impact and a high integrity impact. An authenticated attacker can delete arbitrary files across application and operating-system boundaries, which can halt telephony services, disrupt unified communications, and render the host system unstable or unbootable. The integrity impact stems from unauthorized modification (deletion) of protected files. Because the MiVoice Office 400 is a business telephony platform, loss of availability directly affects voice communications, emergency calling, and dependent business workflows. The blast radius is the appliance itself and any services it hosts; lateral movement is not described. A plausible CVSS v3.1 vector reflecting the stated preconditions and impacts is AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H, though no official score or vector was assigned in the provided data. EPSS is not yet scored by FIRST.org. The CVE is not listed in CISA KEV. No public exploit code or Nuclei template exists, which lowers the immediate likelihood of mass exploitation but does not reduce the severity for targeted actors.

Detection Guidance

Sigma Rule

title: Potential Directory Traversal File Deletion Against Mitel MiVoice Office 400 Web Portal
id: 8f2c1a44-9d3e-4b7a-b1c2-6e5f7a8b9c01
status: experimental
description: Detects traversal sequences in HTTP requests to the Mitel MiVoice Office 400 management portal (port 443) targeting the File Browser functionality.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-104810
author: valtersit.com
date: 2026-01-01
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - 'GET'
      - 'POST'
  selection_path:
    cs-uri-query|contains:
      - '../'
      - '..\\'
      - '%2e%2e%2f'
      - '%2e%2e/'
      - '..%2f'
      - '%252e%252e%252f'
  selection_target:
    cs-uri-stem|contains:
      - 'File'
      - 'Maintenance'
      - 'Management'
  condition: selection_method and selection_path and selection_target
falsepositives:
  - Legitimate administrative activity using relative paths
  - Security scanners
level: high
tags:
  - attack.t1190
  - cve.2026.104810

YARA Rule

rule CVE_2026_104810_Mitel_MiVoice_DirTraversal
{
    meta:
        description = "Detects HTTP request patterns indicative of directory traversal exploitation against Mitel MiVoice Office 400 File Browser"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-104810"
        date = "2026-01-01"
        severity = "high"

    strings:
        $trav1 = "../" ascii wide nocase
        $trav2 = "..\\" ascii wide nocase
        $enc1  = "%2e%2e%2f" ascii wide nocase
        $enc2  = "%2e%2e/" ascii wide nocase
        $enc3  = "..%2f" ascii wide nocase
        $dbl   = "%252e%252e%252f" ascii wide nocase
        $app1  = "File" ascii wide
        $app2  = "Management" ascii wide
        $app3  = "Maintenance" ascii wide

    condition:
        uint16(0) == 0x4854 or
        (any of ($trav*) or any of ($enc*) or $dbl) and 2 of ($app*)
}

Suricata IDS Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 443 (msg:"CVE-2026-104810 Mitel MiVoice Office 400 Directory Traversal File Deletion Attempt"; flow:established,to_server; content:".."; http_uri; content:"%2f"; http_uri; pcre:"/(\.\.\/|\.\.\\|%2e%2e%2f|\.\.%2f)/Ui"; classtype:attempted-admin; reference:cve,2026-104810; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-104810; sid:2026104810; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [ network where network.protocol == "http" and destination.port == 443 and
      url.path : ("*File*", "*Management*", "*Maintenance*") ]
  [ network where network.protocol == "http" and
      url.query : ("*../*", "*..\\*", "*%2e%2e%2f*", "*..%2f*") ]

Splunk SPL Query

index=web sourcetype=access_combined OR sourcetype=httplog
| eval uri=coalesce(uri,cs_uri_stem,url)
| eval query=coalesce(uri_query,cs_uri_query,url_query)
| where (match(uri,"(?i)(File|Management|Maintenance)") OR match(query,"(?i)(File|Management|Maintenance)"))
| where match(query,"(?i)(\.\./|\.\.\\\\|%2e%2e%2f|\.\.%2f|%252e%252e%252f)")
| stats count values(uri) as target_uris values(query) as attack_queries by src_ip, dest_ip, status
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-104810">
  <rule id="104810" level="12">
    <decoded_as>web-accesslog</decoded_as>
    <match>\.\./|\.\.\\|%2e%2e%2f|\.\.%2f|%252e%252e%252f</match>
    <regex>(?i)(File|Management|Maintenance)</regex>
    <description>CVE-2026-104810: Potential directory traversal against Mitel MiVoice Office 400 File Browser</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>cve_2026_104810,web_attack,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence is 0/4: UNPATCHED — no patch evidence exists from any tracked source. Vendor fix is not available and no workarounds are documented.

1. Immediate mitigations:

• Restrict network access to the MiVoice Office 400 web portal on TCP port 443. Only allow management access from a trusted, isolated administrative VLAN or via a hardened VPN; do not expose the portal to the internet.
• Enforce strong, unique authentication and apply the principle of least privilege to portal accounts to limit which users can reach Maintenance → File Management → File Browser.
• Deploy the Sigma, Suricata, Elastic, Splunk, and Wazuh detections above to alert on traversal patterns targeting the File Browser.
• Where feasible, take a full system backup so that deleted application and OS files can be restored.

2. Patch/upgrade steps:

• Monitor Mitel's official security advisories and product support channels for a firmware/software update addressing CVE-2026-104810. No patch version is currently known from tracked sources; do not assume a fixed release exists until it is published by the vendor.
• When a fix is released, validate it in a staging environment, then apply to all affected MiVoice Office 400 installations.

3. Long-term hardening:

• Adopt a network segmentation model that isolates telephony management planes from general corporate and internet-facing networks.
• Implement file integrity monitoring (FIM) on the MiVoice Office 400 host to detect unexpected deletions of application and Linux system files.
• Enforce input validation and canonicalization review as a standard requirement (aligning with CWE-31 mitigations) during any vendor or custom integrations.
• Maintain offline backups and a tested disaster-recovery procedure for the telephony platform.

References

• NVD — CVE-2026-104810: https://nvd.nist.gov/vuln/detail/CVE-2026-104810
• MITRE CWE-31 — Path Traversal: 'dir..\filename': https://cwe.mitre.org/data/definitions/31.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• Mitel Product Security Advisories (monitor for vendor advisory): https://www.mitel.com/
• FIRST EPSS (score not yet assigned): https://www.first.org/epss/