Mitel fixes OpenScape Endpoint Management bypass; Brotli fix planned

Mitel fixes OpenScape Endpoint Management bypass; Brotli fix planned

28 October 2026: Mitel has fixed two high-rated flaws in the Node-RED component of OpenScape Endpoint Management, the tool that provisions and manages OpenScape desk phones, in version V1R2.5.1. A second advisory, revised on 29 October, says that same release is still affected by CVE-2026-111497, the out-of-bounds write in Google's Brotli decoder known as node2shell, and that a fix is planned but not yet out.

The Node-RED flaws, fixed in V1R2.5.1

Advisory MISA-2026-0009, issued on 28 October, covers V1 R2.4.0 and earlier:

• MTLVULN-1788, CVSS 8.8: weak validation of redirect URLs and improper authentication let an unauthenticated attacker gain administrative access to Node-RED. It needs a user to take an action, such as following a link.
• MTLVULN-1789, CVSS 7.2: an administrator can run arbitrary commands with elevated privileges, because a resource runs with more privilege than it needs.

Chained, the two take an attacker from a crafted link to commands on the management server. Mitel has requested CVE numbers but none is assigned yet, and it offers no workaround. Rodrigo Duarte Garcia of Telefónica reported both. Details are in knowledge base article KB000128955, which customers without access get through their Mitel partner.

Brotli: V1R2.5.1 still affected

MISA-2026-0010 deals with CVE-2026-111497 in the Brotli decompression library, which Mitel scores 8.1 on CVSS 3.1 and which can let an unauthenticated attacker crash a service and possibly read data or run code with crafted compressed input. OpenScape Endpoint Management V1 R2.5.1 and earlier are listed as affected with a "planned update". Mitel rates the product-specific risk low when it is deployed according to its guidelines. Spain's INCIBE-CERT, which reported both advisories on 29 October, gives the Brotli flaw 9.2 on CVSS 4.0.

Mitel has already updated its Unify Phone and CloudLink cloud services. Revision 2.0 clears a long list of products, including MiVoice MX-ONE, MiVoice 5000, MiVoice Office 400, OpenScape 4000, OpenScape Business and MiContact Center Business, but still has MiVoice Business, MiVoice Connect, MiVoice Border Gateway, OpenScape Voice, OpenScape SBC, MiCollab, several contact-centre products and most desk and DECT phones under investigation.

Upgrading now and watching the rest

Upgrading OpenScape Endpoint Management to V1R2.5.1 removes the Node-RED bypass, and there is no reason to wait for the Brotli fix to do it. Until the planned update arrives, keeping the management interface off untrusted networks limits who can send it crafted input. Owners of the products still marked "investigating" should subscribe to the advisory, since Mitel updates it as each product is assessed.

Brotli's own fix, and the .NET and Node.js updates that ship it, are covered in our earlier items. We list Mitel, and our unified communications software category lists 17 products.

Related on TrustList:

• Slican fixes three flaws in IPx phone exchanges; old models stay exposed
• Takeovers with dates from the exchanges: Tribal votes on 2 October, Gamma on 20 October, SYSTEX tender runs to 5 November
• FreePBX publishes four security advisories on 29 September 2026: update the Pinsets, Sangoma Connect, SIPSTATION and Contact Manager modules

Sources

• Mitel Product Security Advisory MISA-2026-0009: OpenScape Endpoint Management Authentication Bypass and Privilege Escalation, 28 October 2026
• Mitel Product Security Advisory MISA-2026-0010: Brotli Decoder Out-of-bounds Write Vulnerability (node2shell, CVE-2026-111497), revision 2.0, 29 October 2026
• INCIBE-CERT: Múltiples vulnerabilidades en OpenScape Endpoint Management de Mitel, 29 October 2026