CVE-2025-27828 Details
Description
A vulnerability in the legacy chat component of Mitel MiContact Center Business through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4 could allow an unauthenticated attacker to conduct a reflected cross-site scripting (XSS) attack due to insufficient input validation. A successful exploit requires user interaction and could allow an attacker to execute arbitrary scripts with a limited impact on the confidentiality and the integrity.
A reflected cross-site scripting vulnerability has been identified in the legacy chat component of Mitel MiContact Center Business, affecting versions through 10.0.0.4, 10.1.0.0 through 10.1.0.5, and 10.2.0.0 through 10.2.0.4. This vulnerability allows an unauthenticated attacker to conduct a reflected XSS attack due to insufficient input validation. Exploitation requires user interaction and could enable the execution of arbitrary scripts, with a limited impact on confidentiality and integrity.
Users are advised to upgrade to MiContact Center Business version 10.2.0.5 or later. Hotfixes KB571322, KB571372, and KB571320 are also available for versions 10.1.0.5, 10.0.0.4, and 9.5.0.3, respectively. For more information, consult the Mitel Knowledge Base article SO8420 or contact a Mitel Authorized Partner.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jun 24, 2025CISA-ADP
Assessed Jun 24, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://www.mitel.com/support/security-advisories | [email protected] | AdvisoryBundleVendor |
| https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-misa-2025-0003 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | CISA-ADP |
Affected Products
| Product | Versions |
|---|---|
| Mitel MiContact Center Business | >= 10.2.0.0, <= 10.2.0.4 >= 10.1.0.0, <= 10.1.0.5 >= 10.0.0.0, <= 10.0.0.4 <= 9.5.0.3 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 24, 2025 | CVE Modified | CISA-ADP |
| Jun 24, 2025 | New CVE Received | [email protected] |