critical9.8Known exploited
CVE-2022-29499
Mitel MiVoice Connect Data Validation Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-06-27. Federal due date: 2022-07-18.
Apply updates per vendor instructions.
Impact
The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mitel | Mivoice Connect | through 22.20.2300.0 |
Weakness classification
References
- NVD record
- CVE.org record
- CISA KEV catalog
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002
- https://www.mitel.com/support/security-advisories/mitel-product-security-advisory-22-0002
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-29499