CVEvulnerability

CVE-2022-29499

9.8 CRITICAL Known exploited Published 2022-04-26 Modified 2026-08-06 Official page ↗

CISA Known Exploited Vulnerability

Mitel MiVoice Connect Data Validation Vulnerability — Mitel MiVoice Connect

The Service Appliance component in Mitel MiVoice Connect allows remote code execution due to incorrect data validation.

Added to KEV
2022-06-27
Remediation due
2022-07-18
Ransomware use
Known
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2022-29499
Status
Analyzed
Published
2022-04-26
Last modified
2026-08-06
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Weaknesses
CWE-20

Description

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.

Affected configurations

• mitel mivoice connect (<= 22.20.2300.0)

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References