Vulnerability research by our security team.

Mitel is the market leader in unified communications. Mitel MiVoice Office 400 to version R7.2 SP1, running Linux Release 11.0.96.0, does not implement Secure Boot, UEFI Secure Boot, boot/filesystem integrity protection, or LUKS disk encryption.

A malicious person or an attacker with access to the VMDK could therefore modify the virtual disk offline and inject persistent malicious code without being detected. Such code could execute automatically at system startup or when specific application features are triggered, allowing persistence across reboots, since there's no integrity check on system files. This exposes the solution to offline disk tampering, persistent code injection, boot-chain compromise, and lack of integrity verification. The absence of these controls significantly weakens the appliance's trust model and protection against persistent compromise.

The backup restoration mechanism of Mitel MiVoice Office 400 fails to validate the paths, file types, integrity and authenticity of files contained in TGZ archives. An attacker with access to the backup repository can introduce malicious files that are written to the system during restoration, up to arbitrary code execution with root privileges.

CVSS 4.0 score of 8.5 (High), the highest of the eight published CVEs. Network vector, high privileges required, total impact on confidentiality, integrity and availability of the system and adjacent components.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-22 · CWE-73 · CWE-494 · CWE-345 · CWE-434

A path traversal in the Mitel MiVoice Office 400 administration portal (https://<ip>:8443, Administration → View Logs menu) allows reading sensitive system files outside the intended directory.

CVSS 4.0 score of 8.4 (High). Local vector, high privileges required, high impact on confidentiality, integrity and availability, including adjacent components.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-31

Mitel MiVoice Office 400 loads shared libraries (.so) using predictable names and without integrity verification. An attacker can make the system load an attacker-controlled .so file instead of the legitimate module; the code runs with the process privileges and leads to full compromise of the virtual machine.

CVSS 4.0 score of 8.4 (High). Local vector, high privileges required, high impact on confidentiality, integrity and availability.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-426 · CWE-427 · CWE-73 · CWE-494 · CWE-829

The File Management feature of the Mitel MiVoice Office 400 web portal does not properly validate paths: an authenticated user can traverse directories and delete critical application or system files, causing a denial of service.

CVSS 4.0 score of 8.4 (High). Authentication required, high impact on confidentiality, integrity and availability.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-31

The Music on Hold feature of Mitel MiVoice Office 400 improperly validates uploaded files: an attacker can upload a malicious shared object (.so) disguised as a WAV audio file, leading to arbitrary code execution and system compromise.

CVSS 4.0 score of 8.4 (High). Local vector, high privileges required, high impact on confidentiality, integrity and availability.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-434 · CWE-20 · CWE-94 · CWE-829

The System Logs feature of the Mitel MiVoice Office 400 web management portal (TCP 443) fails to properly validate file paths, allowing an attacker to read files outside the intended directory.

CVSS 4.0 score of 5.5 (Medium). Network vector, high privileges required, high impact on confidentiality only.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-31

An authenticated attacker can inject JavaScript into the "Description" field under Configuration → Domains in the Mitel MiVoice Office 400 web portal (TCP 443). The input is not sanitised: the persistent script runs for other users (page manipulation, content injection, phishing).

CVSS 4.0 score of 1.9 (Low). High privileges and user interaction required, low impact.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-79

An authenticated attacker can inject JavaScript into the "Microsoft Exchange mailbox" field of the Mitel MiVoice Office 400 user configuration. The stored script runs whenever the user properties are accessed and can cause a denial of service of the interface.

CVSS 4.0 score of 1.9 (Low). High privileges and user interaction required, low impact.

Published on 5 October 2026 in the global CVE registry by the National Cyber Security Centre NCSC (the Swiss Confederation's CVE Numbering Authority). Affected product: Mitel MiVoice Office 400 version 11.0.96.0 (Linux). Found by DigitalCanion SA (researcher: Brian Mariani, credited on the CVE record).

Weaknesses (CWE): CWE-79

DigitalCanion SA, through its researcher Brian Mariani, identified an uncontrolled resource consumption vulnerability (CWE-400 / CWE-770) in WatchGuard Fireware OS, the operating system of Firebox firewalls. A low-privileged, authenticated user can cause a denial of service of the system's diagnostic tools by repeatedly starting and aborting a specially crafted diagnostic task through the web UI. Referenced as DGI-SWISS-00024 and reported to the vendor on September 1, 2026, it was assigned CVE-2026-18105 with a CVSS 7.1 (High, v4.0) score in the official WatchGuard PSIRT advisory of September 29, 2026, which credits "Brian Mariani of DigitalCanion SA". Affected versions: Fireware OS 2026.3 to 2026.3.1, 2025.0 to 2026.2.2, 12.0 to 12.12.2 and 12.0 to 12.5.20 (T15/T35). Fixed in Fireware OS 2026.3.2, 2026.2.3, 12.12.3 and 12.5.21. No known exploitation in the wild. The vulnerability is now public: a fix is available and Firebox users are advised to update Fireware OS without delay.

DigitalCanion SA, through its researcher Brian Mariani, identified a command injection vulnerability in SonicWall Email Security (ES 5000/5050/7000/7050/9000 appliances, VMware and Hyper-V), version 10.0.35.8405 and earlier. An authenticated attacker with access to the restricted CLI can inject OS commands executed as root via the SNMP parameter. Reported on April 16, 2026 and coordinated through the Zero Day Initiative (ZDI-CAN-29029), it was published on August 11, 2026 as CVE-2026-66150 (CVSS 7.8, High) in ZDI advisory ZDI-26-530 and SonicWall advisory SNWLID-2026-0012. Fixed in Email Security 10.0.36.

DigitalCanion SA, through its researcher Brian Mariani, identified a command injection vulnerability in SonicWall Email Security (ES 5000/5050/7000/7050/9000 appliances, VMware and Hyper-V), version 10.0.35.8405 and earlier. An authenticated attacker with access to the restricted CLI can inject OS commands executed as root via the netmask (updateNetIf) parameter. Reported on April 16, 2026 and coordinated through the Zero Day Initiative (ZDI-CAN-29025), it was published on August 11, 2026 as CVE-2026-66149 (CVSS 7.8, High) in ZDI advisory ZDI-26-532 and SonicWall advisory SNWLID-2026-0012. Fixed in Email Security 10.0.36.

DigitalCanion SA identified a security vulnerability affecting SonicWall products and responsibly disclosed it through the Zero Day Initiative (ZDI). The vulnerability was assigned the identifier ZDI-CAN-29024 and was rated CVSS 7.8 (High). The issue was reported on April 16, 2026, and coordinated through ZDI's responsible disclosure process. It is now published as CVE-2026-66148 in SonicWall advisory SNWLID-2026-0011 and ZDI advisory ZDI-26-531. This discovery reflects DigitalCanion's ongoing commitment to proactive security research and responsible vulnerability disclosure.

Two vulnerabilities discovered and disclosed by DigitalCanion SA in SonicWall GMS 9.5.1 and earlier versions. CVE-2026-66148 (CVSS 6.3): an authenticated command injection allowing a low-privileged local user to execute system commands with root privileges, originally coordinated through the Zero Day Initiative (ZDI-CAN-29024). CVE-2026-66146 (CVSS 5.5): multiple Cross-Site Scripting vulnerabilities allowing execution of JavaScript in a user's browser. Published in the official SonicWall advisory SNWLID-2026-0011 of August 11, 2026, and fixed by the vendor in GMS 9.5.2.

DigitalCanion SA, through its researcher Brian Mariani, identified multiple Cross-Site Scripting vulnerabilities in OPNsense 26.7.1_1, responsibly disclosed and published by the vendor in its GitHub security advisory (GHSA-9h93-hhcx-957c, 12 August 2026). The first is a stored Cross-Site Scripting (Description field under Interfaces → Assignments): an attacker can inject JavaScript that executes for any user viewing the interface configuration, including root accounts. The second is a reflected Cross-Site Scripting in Firewall → Log Files → Live View. Weaknesses: CWE-79 (Cross-site Scripting) and CWE-116 (improper output encoding/escaping). Severity: Low. A CVE identifier will soon be assigned via OPNsense; this page will be updated once it is published.

DigitalCanion SA identified a security vulnerability affecting SonicWall products and responsibly disclosed it through the Zero Day Initiative (ZDI). The vulnerability was assigned the identifier ZDI-CAN-28924 and was rated CVSS 7.2 (High). The issue was reported on July 21, 2026, and coordinated through ZDI's responsible disclosure process; public disclosure scheduled for November 18, 2026. This discovery reflects DigitalCanion's ongoing commitment to proactive security research and responsible vulnerability disclosure.

Critical vulnerability in a Mitel product, rated CVSS 9.1. Reported on 1 September 2026 and undergoing coordinated disclosure ahead of public CVE publication. Discovered by Brian Mariani.

High-severity vulnerability in a Mitel product, rated CVSS 7.1. Reported on 1 September 2026 and undergoing coordinated disclosure ahead of public CVE publication. Discovered by Brian Mariani.

DigitalCanion SA, through its researcher Brian Mariani, identified a high-severity vulnerability in a Kyocera product, rated CVSS 7.1 (High). Referenced as DGI-SWISS-00034, it has been reported to the vendor and is undergoing coordinated disclosure. Technical details and the CVE identifier will be published once the embargo period ends; this page will be updated upon release.

DigitalCanion SA, through its researcher Brian Mariani, identified a medium-severity vulnerability in Koozali SME Server, rated CVSS 6.5 (Medium). Referenced as DGI-SWISS-00035, it has been reported to the vendor and is undergoing coordinated disclosure. Technical details and the CVE identifier will be published once the embargo period ends; this page will be updated upon publication.

DigitalCanion SA, through its researcher Brian Mariani, identified a high-severity vulnerability in Koozali SME Server, rated CVSS 7.0 (High). Referenced as DGI-SWISS-00036, it has been reported to the vendor and is undergoing coordinated disclosure. Technical details and the CVE identifier will be published once the embargo period ends; this page will be updated upon publication.

Three vulnerabilities identified in the SonicWall Email Security (antispam) solution that may put the email infrastructure at risk: CVE-2026-3468, CVE-2026-3469 and CVE-2026-3470. Prompt remediation is essential to reduce exposure of a critical messaging layer.

Two security vulnerabilities identified and disclosed in SonicWall products, reported through the appropriate channels and fixed by the vendor. An illustration of the importance of continuous security testing, transparency and responsible disclosure.

A vulnerability discovered in VMware 17.6. Although Broadcom acknowledged the issue, it stated it would only resolve it "in upcoming versions", with no clear timeline. A full technical report documents the finding.

Multiple critical vulnerabilities affecting SonicWall SSL VPN. Although their exploitation requires read and write access to the machine's virtual disk, this demonstration illustrates how quickly a malicious insider, or an attacker who has obtained such access, can compromise the security of the SSL VPN system. Despite their impact, these design flaws were not fixed by SonicWall. This solution is now end-of-life and no longer maintained.

An attacker with R/W access to the VM's storage can tamper with system binaries. Modifying the SSH daemon injects an arbitrary shell, guaranteeing highly persistent remote access that survives reboots, despite deceptive integrity-validation messages. Furthermore, cleartext communication between the GUI and the backend enables theft of administrator credentials. Sophos declined to fix these design flaws; no patch is expected.

While this attack requires prior access to the virtual machine's disks, that constraint cannot justify the absence of adequate protection mechanisms. As it stands, the Sophos firewall solution shows significant shortcomings in reliability and resilience against unauthorized modifications of its files.

File integrity verification at startup is a fundamental security measure for this type of solution. Had an integrity-checking mechanism been implemented, any unauthorized modification would have been detected and corrected at the next reboot or update. The persistence of the attack would then have been limited to the interval before the system's next reboot or update.

We immediately reported this vulnerability to Sophos. However, the vendor declined to implement the security mechanisms needed to address this weakness.

A vulnerability affecting a Novell product (vendor-internal reference: bug 874533), published in the global registry as CVE-2014-0610. This research is part of the track record of Brian Mariani, now a cybersecurity expert at DigitalCanion SA. Full technical details are available in the reference entries below (Shodan, Tenable, VulDB, Debian, the CVE registry and NVD).

Vulnerability published by Apple in the QuickTime 7.3.1 security bulletin. This research is part of the track record of Brian Mariani (then a researcher at Syseclabs), now a cybersecurity expert at DigitalCanion SA.

CVE ID: CVE-2007-4707Available for: Mac OS X v10.3.9, Mac OS X v10.4.9 or later, Mac OS X v10.5 or later, Windows Vista and Windows XP SP2.Impact: QuickTime's Flash media handler contains multiple security vulnerabilities.

Description: Multiple vulnerabilities were identified in QuickTime's Flash media handler; the most serious could allow an attacker to execute arbitrary code on the computer. Apple addressed the issue by disabling the Flash media handler in QuickTime, except for a limited number of existing QuickTime movies considered safe. In its security bulletin, Apple credits Tom Ferris of the Adobe Secure Software Engineering Team (ASSET), Mike Price of McAfee Avert Labs, security researchers Lionel d'Hauenens and Brian Mariani of Syseclabs, and an anonymous researcher working with TippingPoint's Zero Day Initiative for reporting this issue.