Mitel · MiVoice Connect

CVE-2022-29499

Mitel MiVoice Connect Data Validation Vulnerability

Exploited in attacks Used by ransomware Critical 9.8 Attack chance: 55%

What it is

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

CISA: The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: July 18, 2022

Added to the CISA list: June 27, 2022
Published: April 26, 2022
Severity: Critical 9.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 55% in the top 1.0% of all known vulnerabilities
Weakness: CWE-20
More details: NVD · CVE.org · CISA

All references (1)

https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002

More exploited flaws from Mitel

Added	Vulnerability	Product	Severity	Attack chance
Feb 21, 2023	Command InjectionCVE-2022-40765used by ransomware	MiVoice Connect	Medium 6.8	11%
Feb 21, 2023	Code InjectionCVE-2022-41223used by ransomware	MiVoice Connect	Medium 6.8	11%
Feb 12, 2025	Argument InjectionCVE-2024-41710	SIP Phones	Medium 6.8	42%
Jan 7, 2025	Path TraversalCVE-2024-41713used by ransomware	MiCollab	Critical 9.1	97%
Jan 7, 2025	Path TraversalCVE-2024-55550used by ransomware	MiCollab	Medium 4.4	38%
Mar 25, 2022	Access ControlCVE-2022-26143	MiCollab, MiVoice Business Express	Critical 9.8	87%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.