An issue was discovered on Mitel ICP VoIP 3100 devices.

Published 19 mo ago 2025-04-01 · modified 4 mo ago 2026-06-16 · JSON

CVSS

5.6

v3.1 · CNA

CISA KEV

not known exploited

EPSS

1.6%

percentile 76%

Public exploits

Exploit-DB

An issue was discovered on Mitel ICP VoIP 3100 devices. When a remote user attempts to log in via TELNET during the login wait time and an external call comes in, the system incorrectly divulges information about the call and any SMDR records generated by the system. The information provided includes the service type, extension number and other parameters, related to the call activity.

CISA SSVC assessment

Exploitation: none
Automatable: no
Technical impact: partial
Assessed: 19 mo ago 2025-04-04

Exploit prediction (EPSS)

1.64% probability of exploitation in the next 30 days, higher than 76% of all scored CVEs.

Exploits and detections

EDB-49176 Mitel mitel-cs018 - Call Data Information Disclosure · remote · 2020-12-02

CVSS scores

Assigned by	Version	Score	Vector
CISA ADP	3.1	5.6	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L`
CNA	3.1	5.6	`CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L`

Classification

Weakness

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

packetstorm.news /files/id/31445
olografix.org /acme/mitel.txt
rb.gy /1smt22
exploit-db.com /exploits/49176

Sources

CVE List: CVE-2003-20001
NVD: CVE-2003-20001

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.

Summary