CVE-2022-29499criticalunder attackransomwareCWE-20

CVE-2022-29499

Published · Updated

Follow this CVE+ Monitor MiVoice Connect

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA.

ssvc Actcvss 9.8epss 55%
from disclosure to weapon
Published on NVDApr 26
CISA KEV+62d
Action required by CISAfederal deadline: 2022-07-18

Apply updates per vendor instructions.

In short

Mitel MiVoice Connect's Service Appliance has a flaw that allows attackers to run malicious code remotely without proper authentication. This is critical because it can give attackers complete control over the communication system.

Technical detail

CWE-20 improper input validation in Mitel MiVoice Connect Service Appliance (SA 100, SA 400, Virtual SA) up to version 19.2 SP3 enables unauthenticated remote code execution. The vulnerability stems from insufficient data validation, allowing attackers to inject and execute arbitrary commands on affected appliances.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Service Appliance component in Mitel MiVoice Connect through 19.2 SP3 allows remote code execution because of incorrect data validation. The Service Appliances are SA 100, SA 400, and Virtual SA.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a