Mitel · MiVoice Connect

CVE-2022-41223

Mitel MiVoice Connect Code Injection Vulnerability

Exploited in attacks Used by ransomware Medium 6.8 Attack chance: 11%

What it is

The Director database component of MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker to conduct a code-injection attack via crafted data due to insufficient restrictions on the database data type.

CISA: The Director component in Mitel MiVoice Connect allows an authenticated attacker with internal network access to execute code within the context of the application.

What to do

Apply updates per vendor instructions.

Deadline for US federal agencies: March 14, 2023

Added to the CISA list: February 21, 2023
Published: November 22, 2022
Severity: Medium 6.8 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 11% in the top 4.2% of all known vulnerabilities
Weakness: CWE-94
More details: NVD · CVE.org · CISA

All references (2)

More exploited flaws from Mitel

Added	Vulnerability	Product	Severity	Attack chance
Feb 21, 2023	Command InjectionCVE-2022-40765used by ransomware	MiVoice Connect	Medium 6.8	11%
Jun 27, 2022	Data ValidationCVE-2022-29499used by ransomware	MiVoice Connect	Critical 9.8	55%
Feb 12, 2025	Argument InjectionCVE-2024-41710	SIP Phones	Medium 6.8	42%
Jan 7, 2025	Path TraversalCVE-2024-41713used by ransomware	MiCollab	Critical 9.1	97%
Jan 7, 2025	Path TraversalCVE-2024-55550used by ransomware	MiCollab	Medium 4.4	38%
Mar 25, 2022	Access ControlCVE-2022-26143	MiCollab, MiVoice Business Express	Critical 9.8	87%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.