CVE-2023-40263 is a high severity (CVSS 8.8) command injection in Atos Unify OpenScape Voice Trace Manager V8 before V8 R0.9.11. The record says it allows authenticated command injection via ftp. Update to V8 R0.9.11 or later and restrict who can sign in.
What's affected
The record names Atos Unify OpenScape Voice Trace Manager V8, with releases before V8 R0.9.11 affected. The CPE entry in the record lists the vendor as Unify, with Mitel also appearing in related product strings. It scores the flaw 8.8 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
That vector means a network attack, low complexity, low privileges and no user interaction. The attacker needs an account, but nothing more than a basic one.
The weakness class is CWE-77 (improper neutralization of special elements used in a command). Unify's advisory PDF named in the record returned a not found error when we tried to fetch it, so what follows rests on the NVD record. Confirm details with the vendor advisory before you rely on this page for a change decision.
How to check if you're exposed
Trace Manager is server software, so the check is on the server. Find the installed release in the product's about or version page, or ask the team that administers your telephony platform. Any value below V8 R0.9.11 is affected according to the record.
Also list who holds an account on Trace Manager and from which networks it is reachable. Because the flaw needs authentication, an account list and a firewall rule are part of the answer, not just the patch.
What to do now
- Identify every OpenScape Voice Trace Manager instance and its version.
- Plan the upgrade to V8 R0.9.11 or later with the team that runs your telephony platform, and read the Unify advisory OBSO-2305-02 first.
- Until it is patched, limit network access to the Trace Manager interface to administrators and management networks.
- Review accounts, remove any that are unused and rotate passwords on the rest.
- Watch the server for unexpected processes or outbound connections after a change window.
Why it matters
Command injection happens when input is passed to a system command without neutralising special characters. The record points at an ftp related path, which suggests that a file transfer feature is where user supplied data reaches a command. We do not have the vendor's technical text, so we leave the detail there.
The reason this ranks High despite needing a login is the impact scoring. A successful attack gives control over confidentiality, integrity and availability of the server. An authenticated account is not much of a barrier if credentials are weak or shared.
Quick check
Is a login really required?
Yes. The record says authenticated command injection, and the vector lists low privileges required. That is why the score is 8.8 and not higher.
What if I cannot find the fix version?
The record says before V8 R0.9.11. If your vendor channel cannot confirm a build, ask Unify support, and keep the interface off untrusted networks in the meantime.
Sources
Last reviewed: 19 October 2026.
