CVE-2020-28351: The conferencing component on Mitel ShoreTel 19.46.1802.0 devices could allow an unauthenticated attacker t...

Security readout for executives and security teams

CVE-2020-28351 is a reflected XSS issue in the conferencing component of Mitel ShoreTel 19.46.1802.0 devices. An unauthenticated attacker could cause script execution in a user’s browser if the user interacts with a crafted request. The provided sources do not name a patch or show active exploitation. Exposure is most likely where ShoreTel conferencing interfaces are reachable by users or the internet. Risk is higher for externally accessible conferencing portals and users with elevated application access. The bundle does not confirm other affected versions or products. Treat this as a moderate web application exposure. It is not confirmed as actively exploited, but public disclosure and unauthenticated reachability make internet-facing systems worth prioritizing for restriction, vendor review, and upgrade planning. Mitigation focus: Check Mitel guidance for supported ShoreTel remediation or replacement direction.; Restrict external access to ShoreTel conferencing interfaces where possible.; Place affected conferencing pages behind trusted network or VPN access..

Prepared

Jun 5, 2026, 13:31 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.