Critical severity · published Apr 26, 2022
CVE-2022-29499
Mitel MiVoice Connect Data Validation Vulnerability
RansomwareIn wildKEV
9.8
CVSS
55.2%
EPSS
Yes
On KEV
Description
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)55.2% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Jun 27, 2022
Federal remediation dueJul 18, 2022
Ransomware campaign useKnown
Affected products
Which versions
MC
Mivoice Connect · Mitel
through 22.20.2300.0 · source: NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2022-29499
CVE.org
https://www.cve.org/CVERecord?id=CVE-2022-29499
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002
More from Mivoice Connect
6.8
CVE-2022-41223
Mitel MiVoice Connect Code Injection Vulnerability
6.8
CVE-2022-40765
Mitel MiVoice Connect Command Injection Vulnerability
9.8
CVE-2023-32748
The Linux DVS server component of Mitel MiVoice Connect through 19.3 SP2 (22.24.1500.0) could allow an unauthenticated attacker with internal network access to execute arbitrary…
9.8
CVE-2023-31458
A vulnerability in the Edge Gateway component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal network…
9.8
CVE-2023-31457
A vulnerability in the Headquarters server component of Mitel MiVoice Connect versions 19.3 SP2 (22.24.1500.0) and earlier could allow an unauthenticated attacker with internal…