9.8Critical
KEV
Used in ransomware
CVE-2022-29499Mitel MiVoice Connect Data Validation Vulnerability
Known exploited — Mitel MiVoice Connect Data Validation Vulnerability
CISA confirmed this vulnerability is used in real attacks on 27.06.2022. Remediation deadline for US federal agencies: 18.07.2022.
Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2022-29499
Description
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
Weakness (CWE):
CWE-20
Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.
Affected products and versions
| Vendor | Product | Versions | |
|---|---|---|---|
| mitel | mivoice connect | ≤ 22.20.2300.0 |
References and patches
CPE matches (NVD) (1)
cpe:2.3:a:mitel:mivoice_connect:*:*:*:*:*:*:*:*≤ 22.20.2300.0